fix(studio): Add solid floor collision, live 3D gizmo dragging, inspector property sync, and nudge shortcuts

- Creator Studio: Visual behavior & property inspector, GLB model importer, binary persistence
- Trust & Safety: 18+ TOS confirmation (DOB removed), creator guidelines & briefing card on join, in-game reporting HUD
- Test Harness: Add --filter, --skip-backend, --skip-godot to run_checkpoint_tests.py

.gitignore

@@ -12,3 +12,7 @@ Thumbs.db
 # Godot UID files (regenerated from path)
 *.uid
 assets/build_info.json
+
+# Dynamic uploads
+uploads/
+backend/uploads/

AGENTS.md

@@ -0,0 +1,40 @@
+# ModBison (Project & Agent Guidelines)
+
+> **CRITICAL REBRANDING NOTICE**
+> - **Game Name**: **ModBison** (formerly `agp-game`).
+>   - "ModBison" represents a play on game modification and the 1960s British "mod" subculture, adhering to the user's "bison" project naming convention (e.g. host machine `cloudbison`, Windows client machine `pinkbison`, social platform `WiseBison`).
+> - **In-Game Currency**: **Buffalo Chips** (formerly `Credits` / `CR`).
+>   - Named playfully after bison poop. Displayed throughout all UI menus, wallet, marketplace, and creator payout screens as "Buffalo Chips".
+> - **Git Repository**:
+>   - Local clone path: `/home/daddy/modbison` (symlinked as `/home/daddy/agp-game-dev` for backwards compatibility).
+>   - Gitea repository name: `modbison`
+>   - Clone URL: `http://localhost:3000/daddy/modbison.git`
+>   - Web UI: `https://git.cloudbison.duckdns.org/daddy/modbison`
+> - **Binaries & Exports**:
+>   - Windows: `modbison.exe` (legacy alias `agp-game.exe` maintained for backwards compatibility)
+>   - Linux: `modbison.x86_64`
+
+---
+
+## Architecture Overview
+
+1. **Client**: Godot 4.6.2 (GDScript).
+   - Headless engine binary located at `~/godot/godot`.
+   - Export presets defined in `export_presets.cfg`.
+   - Main scenes in `res://scenes/` (`main_menu.tscn`, `world_3d.tscn`, `wallet_ui.tscn`, `marketplace_ui.tscn`, `selling_payout_ui.tscn`, etc.).
+   - Scripts in `res://scripts/`.
+
+2. **Backend**: FastAPI + SQLAlchemy (asyncpg) + Alembic in `backend/`.
+   - Python environment: `/home/daddy/agp/venv` (or project `.venv`).
+   - Runtime game server supervisor allocates headless Godot instances per active world session under `/tmp/modbison-game-servers`.
+
+3. **Orchestration & Playtesting (`/home/daddy/agp`)**:
+   - PM Dashboard: `http://localhost:7070` (`agp-dashboard.service`).
+   - Checkpoint system: `pm/checkpoint_ops.py` controls playtest instances (`PC1` through `PC5`).
+   - Current active checkpoint: **PC5** (backend on `http://192.168.58.138:28005`, postgres on `25545`).
+   - Building Windows package: `PYTHONPATH=. /home/daddy/agp/venv/bin/python3 -c "import pm.checkpoint_ops as ops; ops.build_exe('PC5')"`
+
+4. **Testing Protocols**:
+   - Headless smoke tests: `AGP_API_BASE_URL=http://127.0.0.1:28005 ~/godot/godot --headless --path . --script res://scripts/smoke_test_<name>.gd`
+   - Fast checkpoint tests: `PYTHONPATH=. /home/daddy/agp/venv/bin/python3 scripts/run_checkpoint_tests.py --skip-backend --filter <keyword>`
+   - Backend pytest: `PYTHONPATH=. /home/daddy/agp/venv/bin/pytest backend/tests`

CLAUDE.md

@@ -0,0 +1,18 @@
+# ModBison Guidelines for Claude Code
+
+See [AGENTS.md](AGENTS.md) for full project conventions.
+
+### Quick Reference:
+- **Game Name**: ModBison (formerly agp-game)
+- **Currency**: Buffalo Chips (formerly Credits / CR)
+- **Repo URL**: `http://localhost:3000/daddy/modbison.git` (`https://git.cloudbison.duckdns.org/daddy/modbison`)
+- **Working Tree**: `/home/daddy/modbison` (or `/home/daddy/agp-game-dev`)
+- **Windows Executable**: `modbison.exe`
+- **Linux Executable**: `modbison.x86_64`
+
+### Commands:
+- **Run tests**:
+  - Backend: `PYTHONPATH=. /home/daddy/agp/venv/bin/pytest backend/tests`
+  - Godot UI smoke tests: `AGP_API_BASE_URL=http://127.0.0.1:28004 ~/godot/godot --headless --path . --script res://scripts/smoke_test_<name>.gd`
+- **Rebuild PC4 Windows package**:
+  - `PYTHONPATH=. /home/daddy/agp/venv/bin/python3 -c "import pm.checkpoint_ops as ops; ops.build_exe('PC4')"`

README.md

@@ -1,3 +1,129 @@
-# agp-game
+# ModBison
 
-Agentic Game Platform - Godot game built by autonomous agents
+> **Godot 4 Multiplayer Sandbox Platform**  
+> Customizable 3D avatars, real-time multiplayer worlds, in-game building tools, social community hubs, and a creator economy powered by **Buffalo Chips**.
+
+---
+
+## 🦬 About ModBison
+
+**ModBison** (formerly `agp-game`) is a collaborative sandbox game and platform built in Godot 4 and Python FastAPI. 
+
+* **The Name**: "ModBison" is a double play on game modification and the 1960s British "mod" youth subculture, aligning with the host and infrastructure naming convention (`cloudbison`, `pinkbison`, `WiseBison`).
+* **The Currency**: **Buffalo Chips** — the in-game virtual currency used for marketplace trading, creator selling, and cash payouts (a playful reference to bison poop).
+
+---
+
+## 🏛️ Architecture Overview
+
+The platform consists of two integrated environments:
+
+1. **Client & Game Server (`modbison`)**:
+   - Built with **Godot 4.6.2** (GDScript).
+   - Headless Godot dedicated server (`scenes/server.tscn`) spawned per active world session via high ENet ports.
+   - Dual-platform export configuration: Windows Desktop (`modbison.exe`) and Linux (`modbison.x86_64`).
+   - Binary chunk streaming and client-side interpolation.
+
+2. **Backend & Orchestration Platform (`agp`)**:
+   - **FastAPI** (Python 3.12) REST API with **PostgreSQL** (asyncpg) and **Alembic** migrations.
+   - **Redis** for real-time presence heartbeats and pub/sub messaging.
+   - **Game Server Supervisor**: Dynamic headless Godot instance orchestrator allocating runtime servers in `/tmp/modbison-game-servers`.
+   - **PM Dashboard & Checkpoints**: Live orchestration dashboard running at `http://localhost:7070` managing Package Checkpoints (**PC1** through **PC4**).
+
+---
+
+## ✨ What Has Been Built (Feature Summary)
+
+### 1. 👤 3D Avatar & Customization Engine
+* **Canonical Rig**: 24-bone skeleton supporting attachment sockets for Head, Hair, Face, Chest, Pants, Left/Right Hand, Left/Right Foot, and Accessories.
+* **Customization Studio** (`scenes/avatar_customization.tscn`): Full 3D turntable preview, orbit camera controls, slot-based equipment, RGB tint pickers, and backend persistence (`/api/avatar/loadout`).
+* **Multiplayer Replication**: Remote players receive complete avatar loadout dictionaries via RPC upon joining, dynamically assembling meshes and materials in real time.
+* **Solid Double-Sided Rendering**: Fixed polygon winding order and material setups to ensure characters render fully solid from all camera angles.
+
+### 2. 🌍 Multiplayer World & Chunk Streaming
+* **Dedicated Server Architecture**: Server-authoritative player movement, client prediction, reconciliation, and collision boundaries.
+* **Chunk Streaming**: Binary stream encoding/decoding (`chunk_codec.py` / `chunk_data_decoder.gd`) enabling real-time streaming of world geometry, collision boxes, and dynamic props as players explore.
+* **Stable Spawn System**: Server-authoritative solid ground anchoring ensuring players never fall into the void upon connection.
+
+### 3. 🛠️ In-Game World Editor & Sandboxed Scripting
+* **Runtime World Editor** (`scripts/editor/`): In-game tool registry, block/prop palette, selection manager, raycast placement/deletion, and undo/redo action stacks.
+* **Chunk Persistence** (`chunk_save_service.gd`): Saves player modifications and created structures back to the world backend.
+* **Rule-Based Scripting** (`scripts/scripting/`): Sandboxed behavior interpreter (`script_interpreter.gd`, `script_rule.gd`) allowing props to trigger gameplay actions, inventory changes, and spawn events.
+* **In-Game HUD Bar**: Hotkey-driven overlay bar giving players instant access to build tools and menus while inside a live world.
+
+### 4. 👥 Social, Chat & Clans
+* **Friends & Presence** (`scenes/friends_presence_ui.tscn`): Friend requests, accept/decline flows, and live online/in-world presence heartbeats via Redis.
+* **Multi-Channel Chat** (`scenes/chat_ui.tscn`): Direct messaging (DM), group chat, and spatial in-world chat with automated text filtering (`text_filter.py`).
+* **Groups & Clans** (`scenes/groups_ui.tscn`): Group creation, member roles, descriptions, and membership rosters.
+
+### 5. 💰 Virtual Economy & Creator Payouts
+* **In-Game Currency**: **Buffalo Chips** displayed across all menus, wallets, listings, and payout screens.
+* **Wallet UI** (`scenes/wallet_ui.tscn`): Live balance display, quick-purchase packs (+100, +500, +1,000, +5,000 Buffalo Chips), and transaction history ledger.
+* **Marketplace UI** (`scenes/marketplace_ui.tscn`): Browse items for sale, filter by price in Buffalo Chips, search catalog, and instant purchase with inventory delivery.
+* **Creator Selling & Payouts** (`scenes/selling_payout_ui.tscn`): Catalog item listing, price configuration, escrow tracking (Available, In Escrow, Lifetime Earned), and cash payout requests (minimum 100 Buffalo Chips).
+
+### 6. 🌐 Discovery & Catalog
+* **World Discovery UI** (`scenes/discovery_ui.tscn`): Public world browser with search by title, tags, or category.
+* **Trending Algorithm**: Decay-weighted play counts ranking popular worlds on the discovery front page.
+
+---
+
+## 🎮 In-Game Controls & Hotkeys
+
+| Key | Action |
+| :--- | :--- |
+| **`W` `A` `S` `D`** | Move character |
+| **`Space`** | Jump |
+| **`Mouse`** | Look / Camera rotation |
+| **`T`** or **`Enter`** | Open Chat |
+| **`Tab`** or **`F1`** | Open Friends & Social Panel |
+| **`F2`** | Toggle In-Game World Editor |
+| **`ESC`** | Close current modal / Toggle In-Game HUD Menu |
+
+---
+
+## 🚀 Development, Testing & Builds
+
+### Automated Smoke Tests (Headless Godot)
+All UI panels and client subsystems have headless GDScript smoke tests:
+```bash
+# Set target backend (e.g. PC4 playtest instance)
+export AGP_API_BASE_URL=http://127.0.0.1:28004
+
+# Run individual UI & subsystem smoke tests
+~/godot/godot --headless --path . --script res://scripts/smoke_test_main_menu_full_flow.gd
+~/godot/godot --headless --path . --script res://scripts/smoke_test_marketplace_ui.gd
+~/godot/godot --headless --path . --script res://scripts/smoke_test_wallet_ui.gd
+~/godot/godot --headless --path . --script res://scripts/smoke_test_selling_payout_ui.gd
+~/godot/godot --headless --path . --script res://scripts/smoke_test_avatar_in_world.gd
+```
+
+### Backend Test Suite
+```bash
+# Run 335+ FastAPI & SQLAlchemy test suite
+PYTHONPATH=. /home/daddy/agp/venv/bin/pytest backend/tests
+```
+
+### Building Release Binaries
+```bash
+# Export Linux and Windows binaries
+scripts/build.sh
+
+# Or build pre-configured Windows package for current checkpoint (PC4):
+PYTHONPATH=. /home/daddy/agp/venv/bin/python3 -c "import pm.checkpoint_ops as ops; ops.build_exe('PC4')"
+```
+Output artifacts:
+- Windows: `export/windows/modbison.exe` (or `agp/playtest/PC4/build/windows/modbison.exe`)
+- Linux: `export/linux/modbison.x86_64`
+
+---
+
+## 📦 Project Links & Configuration
+
+* **Gitea Repository**: `http://localhost:3000/daddy/modbison.git`
+* **Web Interface**: [https://git.cloudbison.duckdns.org/daddy/modbison](https://git.cloudbison.duckdns.org/daddy/modbison)
+* **Active Playtest Instance**: **PC4**
+  - Backend URL: `http://192.168.58.138:28004`
+  - Database: PostgreSQL on port `25544`
+* **PM Dashboard**: `http://localhost:7070`
+* **Working Directory**: `/home/daddy/modbison` (symlinked as `/home/daddy/agp-game-dev`)

assets/audio/bell.wav.import

@@ -0,0 +1,24 @@
+[remap]
+
+importer="wav"
+type="AudioStreamWAV"
+uid="uid://dvln67rbfmcnt"
+path="res://.godot/imported/bell.wav-c9e8b15c72938ff0cc4247d900f73a2f.sample"
+
+[deps]
+
+source_file="res://assets/audio/bell.wav"
+dest_files=["res://.godot/imported/bell.wav-c9e8b15c72938ff0cc4247d900f73a2f.sample"]
+
+[params]
+
+force/8_bit=false
+force/mono=false
+force/max_rate=false
+force/max_rate_hz=44100
+edit/trim=false
+edit/normalize=false
+edit/loop_mode=0
+edit/loop_begin=0
+edit/loop_end=-1
+compress/mode=2

assets/audio/chime.wav.import

@@ -0,0 +1,24 @@
+[remap]
+
+importer="wav"
+type="AudioStreamWAV"
+uid="uid://uvtdcjsrs4oc"
+path="res://.godot/imported/chime.wav-cbf50c3ed007f7bda834f64e66ec1ffa.sample"
+
+[deps]
+
+source_file="res://assets/audio/chime.wav"
+dest_files=["res://.godot/imported/chime.wav-cbf50c3ed007f7bda834f64e66ec1ffa.sample"]
+
+[params]
+
+force/8_bit=false
+force/mono=false
+force/max_rate=false
+force/max_rate_hz=44100
+edit/trim=false
+edit/normalize=false
+edit/loop_mode=0
+edit/loop_begin=0
+edit/loop_end=-1
+compress/mode=2

assets/audio/click.wav.import

@@ -0,0 +1,24 @@
+[remap]
+
+importer="wav"
+type="AudioStreamWAV"
+uid="uid://cxiiaesukt1ci"
+path="res://.godot/imported/click.wav-726094e36c7052fadb6392aaf7409595.sample"
+
+[deps]
+
+source_file="res://assets/audio/click.wav"
+dest_files=["res://.godot/imported/click.wav-726094e36c7052fadb6392aaf7409595.sample"]
+
+[params]
+
+force/8_bit=false
+force/mono=false
+force/max_rate=false
+force/max_rate_hz=44100
+edit/trim=false
+edit/normalize=false
+edit/loop_mode=0
+edit/loop_begin=0
+edit/loop_end=-1
+compress/mode=2

assets/audio/coin.wav.import

@@ -0,0 +1,24 @@
+[remap]
+
+importer="wav"
+type="AudioStreamWAV"
+uid="uid://cssl2kgkc53is"
+path="res://.godot/imported/coin.wav-e1bec9e9502a5df388e6fd33d4bb5689.sample"
+
+[deps]
+
+source_file="res://assets/audio/coin.wav"
+dest_files=["res://.godot/imported/coin.wav-e1bec9e9502a5df388e6fd33d4bb5689.sample"]
+
+[params]
+
+force/8_bit=false
+force/mono=false
+force/max_rate=false
+force/max_rate_hz=44100
+edit/trim=false
+edit/normalize=false
+edit/loop_mode=0
+edit/loop_begin=0
+edit/loop_end=-1
+compress/mode=2

assets/audio/door_open.wav.import

@@ -0,0 +1,24 @@
+[remap]
+
+importer="wav"
+type="AudioStreamWAV"
+uid="uid://c10qifwxnhin6"
+path="res://.godot/imported/door_open.wav-d530c3547ac0143568ab23d68285c71c.sample"
+
+[deps]
+
+source_file="res://assets/audio/door_open.wav"
+dest_files=["res://.godot/imported/door_open.wav-d530c3547ac0143568ab23d68285c71c.sample"]
+
+[params]
+
+force/8_bit=false
+force/mono=false
+force/max_rate=false
+force/max_rate_hz=44100
+edit/trim=false
+edit/normalize=false
+edit/loop_mode=0
+edit/loop_begin=0
+edit/loop_end=-1
+compress/mode=2

assets/audio/fanfare.wav.import

@@ -0,0 +1,24 @@
+[remap]
+
+importer="wav"
+type="AudioStreamWAV"
+uid="uid://bl6jimdmb1d3u"
+path="res://.godot/imported/fanfare.wav-e0524ad6f859b26eee9ccfabfec4f302.sample"
+
+[deps]
+
+source_file="res://assets/audio/fanfare.wav"
+dest_files=["res://.godot/imported/fanfare.wav-e0524ad6f859b26eee9ccfabfec4f302.sample"]
+
+[params]
+
+force/8_bit=false
+force/mono=false
+force/max_rate=false
+force/max_rate_hz=44100
+edit/trim=false
+edit/normalize=false
+edit/loop_mode=0
+edit/loop_begin=0
+edit/loop_end=-1
+compress/mode=2

assets/avatars/catalog.json

@@ -31,6 +31,14 @@
       "display_name": "Ponytail",
       "mount_bone": "HeadTop"
     },
+    "hair_waterbuffalo_01": {
+      "type": "attachment",
+      "slot": "hair",
+      "path": "res://assets/avatars/hair_waterbuffalo_01.glb",
+      "version": "1.0.0",
+      "display_name": "Water Buffalo Lodge Hat",
+      "mount_bone": "HeadTop"
+    },
     "face_glasses_01": {
       "type": "attachment",
       "slot": "face",
@@ -71,6 +79,14 @@
       "display_name": "Left Glove",
       "mount_bone": "LeftHand"
     },
+    "left_hand_wristband_01": {
+      "type": "attachment",
+      "slot": "left_hand",
+      "path": "res://assets/avatars/left_hand_wristband_01.glb",
+      "version": "1.0.0",
+      "display_name": "Left Gold Band",
+      "mount_bone": "LeftHand"
+    },
     "right_hand_glove_01": {
       "type": "attachment",
       "slot": "right_hand",
@@ -79,6 +95,14 @@
       "display_name": "Right Glove",
       "mount_bone": "RightHand"
     },
+    "right_hand_wristband_01": {
+      "type": "attachment",
+      "slot": "right_hand",
+      "path": "res://assets/avatars/right_hand_wristband_01.glb",
+      "version": "1.0.0",
+      "display_name": "Right Gold Band",
+      "mount_bone": "RightHand"
+    },
     "left_foot_boot_01": {
       "type": "attachment",
       "slot": "left_foot",
@@ -87,6 +111,14 @@
       "display_name": "Left Boot",
       "mount_bone": "LeftFoot"
     },
+    "left_foot_sneaker_01": {
+      "type": "attachment",
+      "slot": "left_foot",
+      "path": "res://assets/avatars/left_foot_sneaker_01.glb",
+      "version": "1.0.0",
+      "display_name": "Left Sneaker",
+      "mount_bone": "LeftFoot"
+    },
     "right_foot_boot_01": {
       "type": "attachment",
       "slot": "right_foot",
@@ -95,6 +127,14 @@
       "display_name": "Right Boot",
       "mount_bone": "RightFoot"
     },
+    "right_foot_sneaker_01": {
+      "type": "attachment",
+      "slot": "right_foot",
+      "path": "res://assets/avatars/right_foot_sneaker_01.glb",
+      "version": "1.0.0",
+      "display_name": "Right Sneaker",
+      "mount_bone": "RightFoot"
+    },
     "accessory_belt_01": {
       "type": "attachment",
       "slot": "accessory",

assets/avatars/hair_waterbuffalo_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://dbpg1j858253k"
+path="res://.godot/imported/hair_waterbuffalo_01.glb-c029a4cc5c7f4da664b2a6ff40a4d5a5.scn"
+
+[deps]
+
+source_file="res://assets/avatars/hair_waterbuffalo_01.glb"
+dest_files=["res://.godot/imported/hair_waterbuffalo_01.glb-c029a4cc5c7f4da664b2a6ff40a4d5a5.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/avatars/left_foot_sneaker_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://cdu5ncc6txi2a"
+path="res://.godot/imported/left_foot_sneaker_01.glb-58178eceb7610b00fcdd19ec562d32ee.scn"
+
+[deps]
+
+source_file="res://assets/avatars/left_foot_sneaker_01.glb"
+dest_files=["res://.godot/imported/left_foot_sneaker_01.glb-58178eceb7610b00fcdd19ec562d32ee.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/avatars/left_hand_wristband_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://bd2pj86s3jgw6"
+path="res://.godot/imported/left_hand_wristband_01.glb-bbb8beaefb98cfa41b275a9c621f1f25.scn"
+
+[deps]
+
+source_file="res://assets/avatars/left_hand_wristband_01.glb"
+dest_files=["res://.godot/imported/left_hand_wristband_01.glb-bbb8beaefb98cfa41b275a9c621f1f25.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/avatars/right_foot_sneaker_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://da2jib466th8w"
+path="res://.godot/imported/right_foot_sneaker_01.glb-54204fa9ac3cba3033c3591ef48c54c7.scn"
+
+[deps]
+
+source_file="res://assets/avatars/right_foot_sneaker_01.glb"
+dest_files=["res://.godot/imported/right_foot_sneaker_01.glb-54204fa9ac3cba3033c3591ef48c54c7.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/avatars/right_hand_wristband_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://b64ejiiluvql4"
+path="res://.godot/imported/right_hand_wristband_01.glb-65f50dbbe9aaf5f2de1555fec5ca3385.scn"
+
+[deps]
+
+source_file="res://assets/avatars/right_hand_wristband_01.glb"
+dest_files=["res://.godot/imported/right_hand_wristband_01.glb-65f50dbbe9aaf5f2de1555fec5ca3385.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/editor/object_catalog.json

@@ -0,0 +1,52 @@
+{
+  "objects": {
+    "crate_small": {
+      "asset_id": "props/crate_small.glb",
+      "type": "prop",
+      "display_name": "Small Crate",
+      "category": "props"
+    },
+    "rock_01": {
+      "asset_id": "props/rock_01.glb",
+      "type": "prop",
+      "display_name": "Rock",
+      "category": "nature"
+    },
+    "tree_pine_01": {
+      "asset_id": "props/tree_pine_01.glb",
+      "type": "prop",
+      "display_name": "Pine Tree",
+      "category": "nature"
+    },
+    "lamp_post_01": {
+      "asset_id": "props/lamp_post_01.glb",
+      "type": "prop",
+      "display_name": "Lamp Post",
+      "category": "props"
+    },
+    "chest_01": {
+      "asset_id": "props/chest.glb",
+      "type": "interactable",
+      "display_name": "Treasure Chest",
+      "category": "interactables"
+    },
+    "buffalo_chip_coin": {
+      "asset_id": "props/buffalo_chip_coin.glb",
+      "type": "prop",
+      "display_name": "Buffalo Chip Coin",
+      "category": "props"
+    },
+    "bison": {
+      "asset_id": "props/bison.glb",
+      "type": "prop",
+      "display_name": "Bison",
+      "category": "nature"
+    },
+    "spawn_point": {
+      "asset_id": "",
+      "type": "spawn_point",
+      "display_name": "Spawn Point",
+      "category": "gameplay"
+    }
+  }
+}

assets/props/bison.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://wa7kf5fvrdh1"
+path="res://.godot/imported/bison.glb-caef5252d8e08046747c7628b6609f07.scn"
+
+[deps]
+
+source_file="res://assets/props/bison.glb"
+dest_files=["res://.godot/imported/bison.glb-caef5252d8e08046747c7628b6609f07.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/props/bison_04bizontexture.jpg.import

@@ -0,0 +1,43 @@
+[remap]
+
+importer="texture"
+type="CompressedTexture2D"
+uid="uid://oemjaiyc1jor"
+path="res://.godot/imported/bison_04bizontexture.jpg-ee62bcbf71190dd9c3260c488d0f5226.ctex"
+metadata={
+"vram_texture": false
+}
+generator_parameters={
+"md5": "62ac14285e2f49777af903582f16d021"
+}
+
+[deps]
+
+source_file="res://assets/props/bison_04bizontexture.jpg"
+dest_files=["res://.godot/imported/bison_04bizontexture.jpg-ee62bcbf71190dd9c3260c488d0f5226.ctex"]
+
+[params]
+
+compress/mode=0
+compress/high_quality=false
+compress/lossy_quality=0.7
+compress/uastc_level=0
+compress/rdo_quality_loss=0.0
+compress/hdr_compression=1
+compress/normal_map=0
+compress/channel_pack=0
+mipmaps/generate=true
+mipmaps/limit=-1
+roughness/mode=0
+roughness/src_normal=""
+process/channel_remap/red=0
+process/channel_remap/green=1
+process/channel_remap/blue=2
+process/channel_remap/alpha=3
+process/fix_alpha_border=true
+process/premult_alpha=false
+process/normal_map_invert_y=false
+process/hdr_as_srgb=false
+process/hdr_clamp_exposure=false
+process/size_limit=0
+detect_3d/compress_to=1

assets/props/buffalo_chip_coin.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://dxjew7eex2jh4"
+path="res://.godot/imported/buffalo_chip_coin.glb-ccee212ee6fb7ddcc2555bc23ea60f4b.scn"
+
+[deps]
+
+source_file="res://assets/props/buffalo_chip_coin.glb"
+dest_files=["res://.godot/imported/buffalo_chip_coin.glb-ccee212ee6fb7ddcc2555bc23ea60f4b.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/props/chest.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://kik8lcd3jp7x"
+path="res://.godot/imported/chest.glb-22b4964b33afcd001921fbaa02f82b8a.scn"
+
+[deps]
+
+source_file="res://assets/props/chest.glb"
+dest_files=["res://.godot/imported/chest.glb-22b4964b33afcd001921fbaa02f82b8a.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/props/crate_small.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://n18xbm0q3jai"
+path="res://.godot/imported/crate_small.glb-e6fdaf315193cd20d4514609adaa68f2.scn"
+
+[deps]
+
+source_file="res://assets/props/crate_small.glb"
+dest_files=["res://.godot/imported/crate_small.glb-e6fdaf315193cd20d4514609adaa68f2.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/props/lamp_post_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://b3nfmxbm87pl3"
+path="res://.godot/imported/lamp_post_01.glb-eea7873c5c7bafcb4d19a09b9d97e53c.scn"
+
+[deps]
+
+source_file="res://assets/props/lamp_post_01.glb"
+dest_files=["res://.godot/imported/lamp_post_01.glb-eea7873c5c7bafcb4d19a09b9d97e53c.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/props/rock_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://boi3fsj4ehqvb"
+path="res://.godot/imported/rock_01.glb-b0b73bccccfa933f3863bdc2afcb3246.scn"
+
+[deps]
+
+source_file="res://assets/props/rock_01.glb"
+dest_files=["res://.godot/imported/rock_01.glb-b0b73bccccfa933f3863bdc2afcb3246.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/props/tree_pine_01.glb.import

@@ -0,0 +1,42 @@
+[remap]
+
+importer="scene"
+importer_version=1
+type="PackedScene"
+uid="uid://b84vjc1c3d650"
+path="res://.godot/imported/tree_pine_01.glb-519f726dc86fdb9eefd0928153fa0181.scn"
+
+[deps]
+
+source_file="res://assets/props/tree_pine_01.glb"
+dest_files=["res://.godot/imported/tree_pine_01.glb-519f726dc86fdb9eefd0928153fa0181.scn"]
+
+[params]
+
+nodes/root_type=""
+nodes/root_name=""
+nodes/root_script=null
+nodes/apply_root_scale=true
+nodes/root_scale=1.0
+nodes/import_as_skeleton_bones=false
+nodes/use_name_suffixes=true
+nodes/use_node_type_suffixes=true
+meshes/ensure_tangents=true
+meshes/generate_lods=true
+meshes/create_shadow_meshes=true
+meshes/light_baking=1
+meshes/lightmap_texel_size=0.2
+meshes/force_disable_compression=false
+skins/use_named_skins=true
+animation/import=true
+animation/fps=30
+animation/trimming=false
+animation/remove_immutable_tracks=true
+animation/import_rest_as_RESET=false
+import_script/path=""
+materials/extract=0
+materials/extract_format=0
+materials/extract_path=""
+_subresources={}
+gltf/naming_version=2
+gltf/embedded_image_handling=1

assets/scripting/behaviors/demo_chest.json

@@ -0,0 +1,17 @@
+{
+  "content_flags": {
+    "violence": "none",
+    "mature": false
+  },
+  "rules": [
+    {
+      "trigger": {"type": "on_interact"},
+      "conditions": [],
+      "actions": [
+        {"verb": "give_item", "item_id": "gold_coin", "count": 3},
+        {"verb": "play_sound", "sound_id": "chest_open"},
+        {"verb": "rotate", "target": "self", "degrees": 90, "axis": "y", "duration": 0.4}
+      ]
+    }
+  ]
+}

assets/scripting/spawn_catalog.json

@@ -0,0 +1,8 @@
+{
+  "templates": {
+    "small_crate": {
+      "asset_id": "props/crate_small.glb",
+      "display_name": "Small Crate"
+    }
+  }
+}

backend/alembic/env.py

@@ -8,7 +8,7 @@ from sqlalchemy.ext.asyncio import create_async_engine
 
 from app.config import settings
 from app.database import Base
-from app.models import user, session, world, asset, avatar_loadout  # noqa: F401
+from app.models import user, session, world, asset, avatar_loadout, world_content  # noqa: F401
 
 # this is the Alembic Config object, which provides
 # access to the values within the .ini file in use.

backend/alembic/versions/0005_add_world_content_tables.py

@@ -0,0 +1,120 @@
+"""add world_rooms, world_chunks, world_chunk_revisions tables
+
+Revision ID: 0005_add_world_content_tables
+Revises: 0004_add_avatar_loadouts_table
+Create Date: 2026-09-14 00:00:00.000000
+
+See docs/architecture/world_persistence_impl.md §4. Chunk content
+(rooms, chunk payloads, chunk revisions) lives in Postgres, purely
+additive to the existing ``worlds`` table.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0005_add_world_content_tables"
+down_revision: Union[str, None] = "0004_add_avatar_loadouts_table"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "world_rooms",
+        sa.Column("id", sa.Integer(), primary_key=True, index=True),
+        sa.Column(
+            "world_id", sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("slug", sa.String(64), nullable=False),
+        sa.Column("name", sa.String(255), nullable=False),
+        sa.Column(
+            "grid", postgresql.JSONB(), nullable=False,
+            server_default='{"size": [32, 32, 1], "origin": [0, 0, 0]}',
+        ),
+        sa.Column("bounds", postgresql.JSONB(), nullable=True),
+        sa.Column("spawn", postgresql.JSONB(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True),
+            server_default=sa.func.now(), nullable=False,
+        ),
+        sa.UniqueConstraint("world_id", "slug", name="uq_world_rooms_world_slug"),
+    )
+    op.create_index("ix_world_rooms_world_id", "world_rooms", ["world_id"])
+
+    op.create_table(
+        "world_chunks",
+        sa.Column("id", sa.Integer(), primary_key=True, index=True),
+        sa.Column(
+            "world_id", sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "room_id", sa.Integer(),
+            sa.ForeignKey("world_rooms.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("chunk_key", sa.String(160), nullable=False, unique=True),
+        sa.Column("cx", sa.Integer(), nullable=False),
+        sa.Column("cy", sa.Integer(), nullable=False),
+        sa.Column("cz", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("format_version", sa.Integer(), nullable=False, server_default="1"),
+        sa.Column("payload", sa.LargeBinary(), nullable=False),
+        sa.Column("payload_len", sa.Integer(), nullable=False),
+        sa.Column("checksum", sa.String(64), nullable=False),
+        sa.Column("revision", sa.Integer(), nullable=False, server_default="1"),
+        sa.Column("content_flags", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("is_mature", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column(
+            "updated_by_id", sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True),
+            server_default=sa.func.now(), nullable=False,
+        ),
+        sa.UniqueConstraint("room_id", "cx", "cy", "cz", name="uq_world_chunks_coord"),
+    )
+    op.create_index("ix_world_chunks_world_id", "world_chunks", ["world_id"])
+    op.create_index("ix_world_chunks_room_id", "world_chunks", ["room_id"])
+    op.create_index(
+        "ix_world_chunks_room_coord", "world_chunks", ["room_id", "cx", "cy", "cz"],
+    )
+    op.create_index(
+        "ix_world_chunks_mature", "world_chunks", ["world_id"],
+        postgresql_where=sa.text("is_mature"),
+    )
+
+    op.create_table(
+        "world_chunk_revisions",
+        sa.Column("id", sa.Integer(), primary_key=True, index=True),
+        sa.Column("chunk_key", sa.String(160), nullable=False),
+        sa.Column("world_id", sa.Integer(), nullable=False),
+        sa.Column("revision", sa.Integer(), nullable=False),
+        sa.Column("action", sa.String(16), nullable=False),
+        sa.Column(
+            "actor_id", sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("checksum", sa.String(64), nullable=False),
+        sa.Column("payload", sa.LargeBinary(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_world_chunk_revisions_chunk_key", "world_chunk_revisions", ["chunk_key"])
+    op.create_index("ix_world_chunk_revisions_world_id", "world_chunk_revisions", ["world_id"])
+    op.create_index("ix_world_chunk_revisions_created_at", "world_chunk_revisions", ["created_at"])
+
+
+def downgrade() -> None:
+    op.drop_table("world_chunk_revisions")
+    op.drop_table("world_chunks")
+    op.drop_table("world_rooms")

backend/alembic/versions/0006_add_presence_columns.py

@@ -0,0 +1,33 @@
+"""add presence columns to users
+
+Revision ID: 0006_add_presence_columns
+Revises: 0005_add_world_content_tables
+Create Date: 2026-09-14 00:00:00.000000
+
+Ported forward from the orphaned agent/dd2a126b57a1 branch (originally
+2a9b9873244a_add_presence_columns.py, down_revision 0001_initial) and
+rebased onto the current migration head. See app/services/presence.py /
+app/routers/presence.py.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0006_add_presence_columns"
+down_revision: Union[str, None] = "0005_add_world_content_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Add last_seen_at and status_message columns to users table."""
+    op.add_column("users", sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=True))
+    op.add_column("users", sa.Column("status_message", sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    """Remove presence columns from users table."""
+    op.drop_column("users", "status_message")
+    op.drop_column("users", "last_seen_at")

backend/alembic/versions/0007_add_social_graph_tables.py

@@ -0,0 +1,118 @@
+"""add social graph tables (friendships, follows, blocks)
+
+Revision ID: 0007_add_social_graph_tables
+Revises: 0006_add_presence_columns
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-1 / app/models/social.py. Models + migration
+only -- the request/accept/block business logic lives in the sibling
+"Friends & follow API router" task.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0007_add_social_graph_tables"
+down_revision: Union[str, None] = "0006_add_presence_columns"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    friendship_status = postgresql.ENUM(
+        "pending", "accepted", name="friendship_status"
+    )
+    friendship_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "friendships",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "requester_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "addressee_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "pending", "accepted", name="friendship_status", create_type=False
+            ),
+            nullable=False,
+            server_default="pending",
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+    op.create_index("ix_friendships_requester_id", "friendships", ["requester_id"])
+    op.create_index("ix_friendships_addressee_id", "friendships", ["addressee_id"])
+
+    op.create_table(
+        "follows",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "follower_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "followed_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+    op.create_index("ix_follows_follower_id", "follows", ["follower_id"])
+    op.create_index("ix_follows_followed_id", "follows", ["followed_id"])
+
+    op.create_table(
+        "blocks",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "blocker_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "blocked_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )
+    op.create_index("ix_blocks_blocker_id", "blocks", ["blocker_id"])
+    op.create_index("ix_blocks_blocked_id", "blocks", ["blocked_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_blocks_blocked_id", table_name="blocks")
+    op.drop_index("ix_blocks_blocker_id", table_name="blocks")
+    op.drop_table("blocks")
+
+    op.drop_index("ix_follows_followed_id", table_name="follows")
+    op.drop_index("ix_follows_follower_id", table_name="follows")
+    op.drop_table("follows")
+
+    op.drop_index("ix_friendships_addressee_id", table_name="friendships")
+    op.drop_index("ix_friendships_requester_id", table_name="friendships")
+    op.drop_table("friendships")
+
+    postgresql.ENUM(name="friendship_status").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0008_add_chat_tables.py

@@ -0,0 +1,178 @@
+"""add chat tables (conversations, messages, message_reports)
+
+Revision ID: 0008_add_chat_tables
+Revises: 0007_add_social_graph_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-4 / app/models/chat.py. Models + migration only
+-- text filtering, rate limiting, and send/report/moderation endpoints live
+in sibling tasks that depend on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0008_add_chat_tables"
+down_revision: Union[str, None] = "0007_add_social_graph_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    message_report_status = postgresql.ENUM(
+        "open", "resolved", "dismissed", name="message_report_status"
+    )
+    message_report_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "conversations",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "user_a_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_b_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        sa.CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+    op.create_index("ix_conversations_user_a_id", "conversations", ["user_a_id"])
+    op.create_index("ix_conversations_user_b_id", "conversations", ["user_b_id"])
+
+    op.create_table(
+        "conversation_participants",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+    op.create_index(
+        "ix_conversation_participants_conversation_id",
+        "conversation_participants",
+        ["conversation_id"],
+    )
+    op.create_index(
+        "ix_conversation_participants_user_id", "conversation_participants", ["user_id"]
+    )
+
+    op.create_table(
+        "messages",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "sender_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "world_id",
+            sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "room_id",
+            sa.Integer(),
+            sa.ForeignKey("world_rooms.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column("body", sa.Text(), nullable=False),
+        sa.Column("filtered", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_messages_sender_id", "messages", ["sender_id"])
+    op.create_index(
+        "ix_messages_conversation_created", "messages", ["conversation_id", "created_at"]
+    )
+    op.create_index("ix_messages_world_created", "messages", ["world_id", "created_at"])
+
+    op.create_table(
+        "message_reports",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "message_id",
+            sa.Integer(),
+            sa.ForeignKey("messages.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "reporter_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("reason", sa.Text(), nullable=False),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "open", "resolved", "dismissed", name="message_report_status", create_type=False
+            ),
+            nullable=False,
+            server_default="open",
+        ),
+        sa.Column(
+            "moderator_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_message_reports_message_id", "message_reports", ["message_id"])
+    op.create_index("ix_message_reports_reporter_id", "message_reports", ["reporter_id"])
+    op.create_index("ix_message_reports_moderator_id", "message_reports", ["moderator_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_message_reports_moderator_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_reporter_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_message_id", table_name="message_reports")
+    op.drop_table("message_reports")
+
+    op.drop_index("ix_messages_world_created", table_name="messages")
+    op.drop_index("ix_messages_conversation_created", table_name="messages")
+    op.drop_index("ix_messages_sender_id", table_name="messages")
+    op.drop_table("messages")
+
+    op.drop_index("ix_conversation_participants_user_id", table_name="conversation_participants")
+    op.drop_index(
+        "ix_conversation_participants_conversation_id", table_name="conversation_participants"
+    )
+    op.drop_table("conversation_participants")
+
+    op.drop_index("ix_conversations_user_b_id", table_name="conversations")
+    op.drop_index("ix_conversations_user_a_id", table_name="conversations")
+    op.drop_table("conversations")
+
+    postgresql.ENUM(name="message_report_status").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0009_add_group_tables.py

@@ -0,0 +1,80 @@
+"""add group tables (groups, group_members)
+
+Revision ID: 0009_add_group_tables
+Revises: 0008_add_chat_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-5 / app/models/groups.py. Models + migration only
+-- create/join/leave, role authorization, and the group page endpoint live
+in a sibling task ("Groups API") that depends on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0009_add_group_tables"
+down_revision: Union[str, None] = "0008_add_chat_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    group_role = postgresql.ENUM("owner", "admin", "member", name="group_role")
+    group_role.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "groups",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("name", sa.String(length=100), nullable=False),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column(
+            "owner_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_groups_owner_id", "groups", ["owner_id"])
+
+    op.create_table(
+        "group_members",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "group_id",
+            sa.Integer(),
+            sa.ForeignKey("groups.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "role",
+            postgresql.ENUM("owner", "admin", "member", name="group_role", create_type=False),
+            nullable=False,
+            server_default="member",
+        ),
+        sa.Column("joined_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("group_id", "user_id", name="uq_group_members_pair"),
+    )
+    op.create_index("ix_group_members_group_id", "group_members", ["group_id"])
+    op.create_index("ix_group_members_user_id", "group_members", ["user_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_group_members_user_id", table_name="group_members")
+    op.drop_index("ix_group_members_group_id", table_name="group_members")
+    op.drop_table("group_members")
+
+    op.drop_index("ix_groups_owner_id", table_name="groups")
+    op.drop_table("groups")
+
+    postgresql.ENUM(name="group_role").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0010_add_profile_tables.py

@@ -0,0 +1,65 @@
+"""add profile tables (profiles, profile_favorites)
+
+Revision ID: 0010_add_profile_tables
+Revises: 0009_add_group_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+app/models/profile.py. Models + migration + owner-only /api/profile/me
+endpoints only -- the public profile view endpoint (GET /api/profile/{user_id})
+belongs to a sibling task that depends on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0010_add_profile_tables"
+down_revision: Union[str, None] = "0009_add_group_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "profiles",
+        sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column(
+            "avatar_asset_id",
+            sa.Integer(),
+            sa.ForeignKey("assets.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("bio", sa.Text(), nullable=True),
+        sa.Column("privacy_json", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_profiles_avatar_asset_id", "profiles", ["avatar_asset_id"])
+
+    op.create_table(
+        "profile_favorites",
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column(
+            "world_id",
+            sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_profile_favorites_world_id", "profile_favorites", ["world_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_profile_favorites_world_id", table_name="profile_favorites")
+    op.drop_table("profile_favorites")
+
+    op.drop_index("ix_profiles_avatar_asset_id", table_name="profiles")
+    op.drop_table("profiles")

backend/alembic/versions/0011_add_dm_last_read.py

@@ -0,0 +1,36 @@
+"""add last_read_at to conversation_participants (DM unread tracking)
+
+Revision ID: 0011_add_dm_last_read
+Revises: 0010_add_profile_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+app/routers/chat_dm.py (DM send/list/conversations endpoints). Unread-count
+tracking is implemented as a last-read timestamp per participant: whenever a
+user fetches a conversation's message history, their
+``conversation_participants`` row's ``last_read_at`` is bumped to "now", and
+the conversation-list endpoint counts messages with
+``created_at > last_read_at`` (or all messages if never read) as unread for
+that participant. Nullable/no default so existing rows (none yet in
+practice, but consistent with "never read") read as "everything unread".
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0011_add_dm_last_read"
+down_revision: Union[str, None] = "0010_add_profile_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "conversation_participants",
+        sa.Column("last_read_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("conversation_participants", "last_read_at")

backend/alembic/versions/0012_add_wallet_and_transactions.py

@@ -0,0 +1,90 @@
+"""add wallets and transactions ledger tables
+
+Revision ID: 0012_add_wallet_and_transactions
+Revises: 0011_add_dm_last_read
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/economy.md US-1 (task 8343bc0a730f).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0012_add_wallet_and_transactions"
+down_revision: Union[str, None] = "0011_add_dm_last_read"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+TRANSACTION_TYPES = (
+    "credit_purchase",
+    "marketplace_purchase",
+    "marketplace_sale",
+    "escrow_release",
+    "payout",
+    "refund",
+    "admin_adjustment",
+)
+
+
+def upgrade() -> None:
+    # 1. Create transaction_type enum for Postgres
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        tx_type_enum = postgresql.ENUM(*TRANSACTION_TYPES, name="transaction_type", create_type=False)
+        tx_type_enum.create(bind, checkfirst=True)
+        tx_type_col = postgresql.ENUM(*TRANSACTION_TYPES, name="transaction_type", create_type=False)
+    else:
+        tx_type_col = sa.Enum(*TRANSACTION_TYPES, name="transaction_type")
+
+    # 2. Create wallets table
+    op.create_table(
+        "wallets",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=False),
+        sa.Column("balance", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.CheckConstraint("balance >= 0", name="check_wallet_balance_non_negative"),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("user_id", name="uq_wallets_user_id"),
+    )
+    op.create_index(op.f("ix_wallets_user_id"), "wallets", ["user_id"], unique=True)
+
+    # 3. Create transactions table
+    op.create_table(
+        "transactions",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("wallet_id", sa.BigInteger(), nullable=False),
+        sa.Column("type", tx_type_col, nullable=False),
+        sa.Column("amount", sa.BigInteger(), nullable=False),
+        sa.Column("balance_after", sa.BigInteger(), nullable=False),
+        sa.Column("reference_type", sa.String(), nullable=True),
+        sa.Column("reference_id", sa.String(), nullable=True),
+        sa.Column("idempotency_key", sa.String(), nullable=True),
+        sa.Column("metadata_json", postgresql.JSONB(astext_type=sa.Text()) if bind.dialect.name == "postgresql" else sa.JSON(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["wallet_id"], ["wallets.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("idempotency_key", name="uq_transactions_idempotency_key"),
+    )
+    op.create_index(op.f("ix_transactions_wallet_id"), "transactions", ["wallet_id"], unique=False)
+    op.create_index(op.f("ix_transactions_idempotency_key"), "transactions", ["idempotency_key"], unique=True)
+    op.create_index(op.f("ix_transactions_created_at"), "transactions", ["created_at"], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_transactions_created_at"), table_name="transactions")
+    op.drop_index(op.f("ix_transactions_idempotency_key"), table_name="transactions")
+    op.drop_index(op.f("ix_transactions_wallet_id"), table_name="transactions")
+    op.drop_table("transactions")
+
+    op.drop_index(op.f("ix_wallets_user_id"), table_name="wallets")
+    op.drop_table("wallets")
+
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        sa.Enum(*TRANSACTION_TYPES, name="transaction_type").drop(bind, checkfirst=True)

backend/alembic/versions/0013_add_marketplace_tables.py

@@ -0,0 +1,146 @@
+"""add marketplace tables: catalog_items, marketplace_listings, purchases, creator_balances
+
+Revision ID: 0013_add_marketplace_tables
+Revises: 0012_add_wallet_and_transactions
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/economy.md US-3, US-4 (task 166836d55365).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0013_add_marketplace_tables"
+down_revision: Union[str, None] = "0012_add_wallet_and_transactions"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+ITEM_TYPES = ("asset", "avatar_item", "experience_pass")
+LISTING_STATUSES = ("active", "sold", "delisted", "removed_by_moderation")
+PURCHASE_STATUSES = ("pending_escrow", "completed", "refunded", "reversed")
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    is_pg = bind.dialect.name == "postgresql"
+
+    # Enums
+    if is_pg:
+        item_type_enum = postgresql.ENUM(*ITEM_TYPES, name="catalog_item_type", create_type=False)
+        item_type_enum.create(bind, checkfirst=True)
+        item_type_col = postgresql.ENUM(*ITEM_TYPES, name="catalog_item_type", create_type=False)
+
+        listing_status_enum = postgresql.ENUM(*LISTING_STATUSES, name="marketplace_listing_status", create_type=False)
+        listing_status_enum.create(bind, checkfirst=True)
+        listing_status_col = postgresql.ENUM(*LISTING_STATUSES, name="marketplace_listing_status", create_type=False)
+
+        purchase_status_enum = postgresql.ENUM(*PURCHASE_STATUSES, name="purchase_status", create_type=False)
+        purchase_status_enum.create(bind, checkfirst=True)
+        purchase_status_col = postgresql.ENUM(*PURCHASE_STATUSES, name="purchase_status", create_type=False)
+    else:
+        item_type_col = sa.Enum(*ITEM_TYPES, name="catalog_item_type")
+        listing_status_col = sa.Enum(*LISTING_STATUSES, name="marketplace_listing_status")
+        purchase_status_col = sa.Enum(*PURCHASE_STATUSES, name="purchase_status")
+
+    # 1. catalog_items
+    op.create_table(
+        "catalog_items",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("owner_id", sa.Integer(), nullable=False),
+        sa.Column("asset_id", sa.Integer(), nullable=True),
+        sa.Column("item_type", item_type_col, nullable=False),
+        sa.Column("name", sa.String(length=100), nullable=False),
+        sa.Column("description", sa.String(length=2000), nullable=True),
+        sa.Column("metadata_json", postgresql.JSONB(astext_type=sa.Text()) if is_pg else sa.JSON(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["owner_id"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["asset_id"], ["assets.id"], ondelete="SET NULL"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_catalog_items_owner_id"), "catalog_items", ["owner_id"], unique=False)
+    op.create_index(op.f("ix_catalog_items_asset_id"), "catalog_items", ["asset_id"], unique=False)
+
+    # 2. marketplace_listings
+    op.create_table(
+        "marketplace_listings",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("catalog_item_id", sa.BigInteger(), nullable=False),
+        sa.Column("seller_id", sa.Integer(), nullable=False),
+        sa.Column("price", sa.BigInteger(), nullable=False),
+        sa.Column("status", listing_status_col, server_default="active", nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.CheckConstraint("price > 0", name="check_listing_price_positive"),
+        sa.ForeignKeyConstraint(["catalog_item_id"], ["catalog_items.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["seller_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_marketplace_listings_catalog_item_id"), "marketplace_listings", ["catalog_item_id"], unique=False)
+    op.create_index(op.f("ix_marketplace_listings_seller_id"), "marketplace_listings", ["seller_id"], unique=False)
+
+    # 3. purchases
+    op.create_table(
+        "purchases",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("listing_id", sa.BigInteger(), nullable=True),
+        sa.Column("buyer_id", sa.Integer(), nullable=False),
+        sa.Column("seller_id", sa.Integer(), nullable=False),
+        sa.Column("price", sa.BigInteger(), nullable=False),
+        sa.Column("platform_fee", sa.BigInteger(), nullable=False),
+        sa.Column("seller_net", sa.BigInteger(), nullable=False),
+        sa.Column("status", purchase_status_col, server_default="pending_escrow", nullable=False),
+        sa.Column("escrow_hold_until", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["listing_id"], ["marketplace_listings.id"], ondelete="SET NULL"),
+        sa.ForeignKeyConstraint(["buyer_id"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["seller_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_purchases_listing_id"), "purchases", ["listing_id"], unique=False)
+    op.create_index(op.f("ix_purchases_buyer_id"), "purchases", ["buyer_id"], unique=False)
+    op.create_index(op.f("ix_purchases_seller_id"), "purchases", ["seller_id"], unique=False)
+
+    # 4. creator_balances
+    op.create_table(
+        "creator_balances",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=False),
+        sa.Column("available", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("pending", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("lifetime_earned", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.CheckConstraint("available >= 0", name="check_creator_available_non_negative"),
+        sa.CheckConstraint("pending >= 0", name="check_creator_pending_non_negative"),
+        sa.CheckConstraint("lifetime_earned >= 0", name="check_creator_lifetime_non_negative"),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("user_id", name="uq_creator_balances_user_id"),
+    )
+    op.create_index(op.f("ix_creator_balances_user_id"), "creator_balances", ["user_id"], unique=True)
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_creator_balances_user_id"), table_name="creator_balances")
+    op.drop_table("creator_balances")
+
+    op.drop_index(op.f("ix_purchases_seller_id"), table_name="purchases")
+    op.drop_index(op.f("ix_purchases_buyer_id"), table_name="purchases")
+    op.drop_index(op.f("ix_purchases_listing_id"), table_name="purchases")
+    op.drop_table("purchases")
+
+    op.drop_index(op.f("ix_marketplace_listings_seller_id"), table_name="marketplace_listings")
+    op.drop_index(op.f("ix_marketplace_listings_catalog_item_id"), table_name="marketplace_listings")
+    op.drop_table("marketplace_listings")
+
+    op.drop_index(op.f("ix_catalog_items_asset_id"), table_name="catalog_items")
+    op.drop_index(op.f("ix_catalog_items_owner_id"), table_name="catalog_items")
+    op.drop_table("catalog_items")
+
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        sa.Enum(*PURCHASE_STATUSES, name="purchase_status").drop(bind, checkfirst=True)
+        sa.Enum(*LISTING_STATUSES, name="marketplace_listing_status").drop(bind, checkfirst=True)
+        sa.Enum(*ITEM_TYPES, name="catalog_item_type").drop(bind, checkfirst=True)

backend/alembic/versions/0014_add_payout_requests.py

@@ -0,0 +1,68 @@
+"""add payout_requests table and payout_status enum
+
+Revision ID: 0014_add_payout_requests
+Revises: 0013_add_marketplace_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/economy.md US-5 (task f5b4684f2e65).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0014_add_payout_requests"
+down_revision: Union[str, None] = "0013_add_marketplace_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+PAYOUT_STATUSES = ("pending", "approved", "paid", "rejected")
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    is_pg = bind.dialect.name == "postgresql"
+
+    if is_pg:
+        payout_status_enum = postgresql.ENUM(*PAYOUT_STATUSES, name="payout_status", create_type=False)
+        payout_status_enum.create(bind, checkfirst=True)
+        payout_status_col = postgresql.ENUM(*PAYOUT_STATUSES, name="payout_status", create_type=False)
+    else:
+        payout_status_col = sa.Enum(*PAYOUT_STATUSES, name="payout_status")
+
+    op.create_table(
+        "payout_requests",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("creator_id", sa.Integer(), nullable=False),
+        sa.Column("amount", sa.BigInteger(), nullable=False),
+        sa.Column("status", payout_status_col, server_default="pending", nullable=False),
+        sa.Column("external_ref", sa.String(length=255), nullable=True),
+        sa.Column("provider_ref", sa.String(length=255), nullable=True),
+        sa.Column("requested_by", sa.Integer(), nullable=False),
+        sa.Column("reviewed_by", sa.Integer(), nullable=True),
+        sa.Column("reviewed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["creator_id"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["requested_by"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["reviewed_by"], ["users.id"], ondelete="SET NULL"),
+        sa.CheckConstraint("amount > 0", name="check_payout_amount_positive"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_payout_requests_creator_id", "payout_requests", ["creator_id"], unique=False)
+    op.create_index("ix_payout_requests_requested_by", "payout_requests", ["requested_by"], unique=False)
+    op.create_index("ix_payout_requests_reviewed_by", "payout_requests", ["reviewed_by"], unique=False)
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    is_pg = bind.dialect.name == "postgresql"
+
+    op.drop_index("ix_payout_requests_reviewed_by", table_name="payout_requests")
+    op.drop_index("ix_payout_requests_requested_by", table_name="payout_requests")
+    op.drop_index("ix_payout_requests_creator_id", table_name="payout_requests")
+    op.drop_table("payout_requests")
+
+    if is_pg:
+        op.execute("DROP TYPE IF EXISTS payout_status")

backend/alembic/versions/0015_add_discovery_metadata.py

@@ -0,0 +1,62 @@
+"""add discovery metadata to worlds and create world_visits table
+
+Revision ID: 0015_add_discovery_metadata
+Revises: 0014_add_payout_requests
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/discovery.md (task b377353b8167).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0015_add_discovery_metadata"
+down_revision: Union[str, None] = "0014_add_payout_requests"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # 1. Add discovery metadata columns to worlds table
+    op.add_column("worlds", sa.Column("category", sa.String(length=100), nullable=True))
+    op.add_column("worlds", sa.Column("tags", postgresql.ARRAY(sa.String()), server_default="{}", nullable=True))
+    op.add_column("worlds", sa.Column("play_count", sa.Integer(), server_default="0", nullable=False))
+    op.add_column("worlds", sa.Column("last_played_at", sa.DateTime(timezone=True), nullable=True))
+
+    op.create_index("ix_worlds_category", "worlds", ["category"], unique=False)
+    op.create_index("ix_worlds_tags", "worlds", ["tags"], unique=False, postgresql_using="gin")
+
+    # 2. Create world_visits table
+    op.create_table(
+        "world_visits",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("world_id", sa.Integer(), nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=True),
+        sa.Column("anonymous_token", sa.String(length=255), nullable=True),
+        sa.Column("visited_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["world_id"], ["worlds.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="SET NULL"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_world_visits_world_id", "world_visits", ["world_id"], unique=False)
+    op.create_index("ix_world_visits_user_id", "world_visits", ["user_id"], unique=False)
+    op.create_index("ix_world_visits_visited_at", "world_visits", ["visited_at"], unique=False)
+    op.create_index("ix_world_visits_world_visited_at", "world_visits", ["world_id", "visited_at"], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_index("ix_world_visits_world_visited_at", table_name="world_visits")
+    op.drop_index("ix_world_visits_visited_at", table_name="world_visits")
+    op.drop_index("ix_world_visits_user_id", table_name="world_visits")
+    op.drop_index("ix_world_visits_world_id", table_name="world_visits")
+    op.drop_table("world_visits")
+
+    op.drop_index("ix_worlds_tags", table_name="worlds", postgresql_using="gin")
+    op.drop_index("ix_worlds_category", table_name="worlds")
+    op.drop_column("worlds", "last_played_at")
+    op.drop_column("worlds", "play_count")
+    op.drop_column("worlds", "tags")
+    op.drop_column("worlds", "category")

backend/alembic/versions/0016_content_guidelines.py

@@ -0,0 +1,30 @@
+"""add content_guidelines column to worlds table
+
+Revision ID: 0016_content_guidelines
+Revises: 0015_add_discovery_metadata
+Create Date: 2026-09-17 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0016_content_guidelines"
+down_revision: Union[str, None] = "0015_add_discovery_metadata"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Check if column already exists (in case partial run added column before version update failed)
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    cols = [c["name"] for c in insp.get_columns("worlds")]
+    if "content_guidelines" not in cols:
+        op.add_column("worlds", sa.Column("content_guidelines", sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("worlds", "content_guidelines")

backend/alembic/versions/0017_add_asset_collections.py

@@ -0,0 +1,53 @@
+"""add asset_collections and collection_assets tables
+
+Revision ID: 0017_add_asset_collections
+Revises: 0016_content_guidelines
+Create Date: 2026-09-22 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0017_add_asset_collections"
+down_revision: Union[str, None] = "0016_content_guidelines"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    tables = insp.get_table_names()
+
+    if "asset_collections" not in tables:
+        op.create_table(
+            "asset_collections",
+            sa.Column("id", sa.Integer(), primary_key=True, index=True),
+            sa.Column("title", sa.String(length=255), nullable=False, index=True),
+            sa.Column("description", sa.Text(), nullable=True),
+            sa.Column("theme", sa.String(length=64), nullable=False, server_default="general", index=True),
+            sa.Column("thumbnail_url", sa.String(length=512), nullable=True),
+            sa.Column("owner_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+            sa.Column("is_public", sa.Boolean(), nullable=False, server_default=sa.text("true"), index=True),
+            sa.Column("tags", sa.String(length=512), nullable=True),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+            sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        )
+
+    if "collection_assets" not in tables:
+        op.create_table(
+            "collection_assets",
+            sa.Column("id", sa.Integer(), primary_key=True, index=True),
+            sa.Column("collection_id", sa.Integer(), sa.ForeignKey("asset_collections.id", ondelete="CASCADE"), nullable=False, index=True),
+            sa.Column("asset_id", sa.Integer(), sa.ForeignKey("assets.id", ondelete="CASCADE"), nullable=False, index=True),
+            sa.Column("sort_order", sa.Integer(), nullable=False, server_default="0"),
+            sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        )
+
+
+def downgrade() -> None:
+    op.drop_table("collection_assets")
+    op.drop_table("asset_collections")

backend/app/config.py

@@ -104,6 +104,22 @@ class Settings(BaseSettings):
     # Kill a world's server this long after its last join with no active
     # players reported.
     GAME_SERVER_IDLE_TIMEOUT_SECONDS: int = 300
+    # How long ensure_server() waits for a spawned server to report
+    # "ready": true in its status file before giving up (503 to the
+    # joining client). See world_persistence_impl.md §7.4 -- content
+    # loading makes a slow start more likely than the old bare-port-bind
+    # wait, so this is a separate, longer-by-default budget.
+    GAME_SERVER_READY_TIMEOUT_SECONDS: float = 20.0
+    # The base URL the dedicated Godot server should call back into this
+    # backend on, for the read-only /api/internal content routes
+    # (world_persistence_impl.md §4.4 / §7).
+    GAME_SERVER_INTERNAL_API_URL: str = "http://127.0.0.1:8000"
+
+    # ── World content persistence (world_persistence_impl.md §4.4) ─────────
+    WORLD_CHUNK_MAX_PAYLOAD_BYTES: int = 1_048_576  # 1 MiB
+    WORLD_CHUNK_MAX_OBJECTS: int = 512
+    WORLD_CHUNK_MAX_BATCH: int = 64
+    WORLD_CHUNK_REVISION_KEEP: int = 20
 
     model_config = SettingsConfigDict(
         env_file=".env",

backend/app/dependencies.py

@@ -53,3 +53,33 @@ async def get_current_user(
 
 
 CurrentUser = Annotated[User, Depends(get_current_user)]
+
+oauth2_scheme_optional = OAuth2PasswordBearer(tokenUrl="/api/auth/login", auto_error=False)
+
+
+async def get_optional_user(
+    token: Annotated[str | None, Depends(oauth2_scheme_optional)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+) -> User | None:
+    """Resolve the JWT bearer token to a User if present and valid, otherwise None."""
+    if not token:
+        return None
+    try:
+        payload = jwt.decode(
+            token, settings.public_pem, algorithms=[settings.ALGORITHM]
+        )
+        user_id: str | None = payload.get("sub")
+        if user_id is None:
+            return None
+        user_id_int = int(user_id)
+    except (JWTError, ValueError, TypeError):
+        return None
+
+    result = await db.execute(select(User).where(User.id == user_id_int))
+    user = result.scalar_one_or_none()
+    if user is None or not user.is_active:
+        return None
+    return user
+
+
+OptionalUser = Annotated[User | None, Depends(get_optional_user)]

backend/app/gateway/__init__.py

@@ -0,0 +1 @@
+"""WebSocket real-time gateway package."""

backend/app/gateway/ws.py

@@ -0,0 +1,538 @@
+"""Real-time WebSocket gateway.
+
+Multiplexes presence, DM, and world-chat delivery over a single WebSocket
+endpoint (docs/planning/social.md US-2, US-4).
+
+Key features:
+- Authentication via JWT token (query param or initial auth frame).
+- Scoped subscriptions to DM conversations and world channels.
+- Server-derived presence heartbeat (Redis TTL refreshed periodically).
+- Broadcast presence changes (online/offline) to mutual friends.
+- Fan-out via Redis pub/sub.
+- Thread-safe & event-loop-safe dispatch for multi-instance and test environments.
+- Graceful reconnect without duplicate delivery or orphaned state.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from contextlib import asynccontextmanager
+from datetime import datetime, timezone
+import json
+import logging
+from typing import Any
+
+from fastapi import APIRouter, WebSocket, WebSocketDisconnect, status
+from jose import JWTError, jwt
+from sqlalchemy import or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+import redis.asyncio as aioredis
+
+from app.config import settings
+from app.database import async_session_factory, get_db
+from app.models.chat import ConversationParticipant
+from app.models.social import Friendship, FriendshipStatus
+from app.models.user import User
+from app.models.world import World, WorldVisibility
+from app.services.presence import presence_store
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+
+@asynccontextmanager
+async def get_db_session():
+    """Helper to acquire an async DB session respecting test overrides if present."""
+    from app.main import app
+
+    override = app.dependency_overrides.get(get_db)
+    if override:
+        res = override()
+        if hasattr(res, "__anext__"):
+            session = await res.__anext__()
+            try:
+                yield session
+            finally:
+                try:
+                    await res.__anext__()
+                except (StopAsyncIteration, Exception):
+                    pass
+            return
+        elif hasattr(res, "__next__"):
+            session = next(res)
+            try:
+                yield session
+            finally:
+                try:
+                    next(res)
+                except (StopIteration, Exception):
+                    pass
+            return
+
+    async with async_session_factory() as session:
+        yield session
+
+
+async def authenticate_token(token: str) -> User | None:
+    """Validate JWT token and return authenticated User, or None."""
+    try:
+        payload = jwt.decode(token, settings.public_pem, algorithms=[settings.ALGORITHM])
+        user_id_raw = payload.get("sub")
+        if user_id_raw is None:
+            return None
+        user_id = int(user_id_raw)
+    except (JWTError, ValueError, TypeError):
+        return None
+
+    async with get_db_session() as db:
+        res = await db.execute(select(User).where(User.id == user_id))
+        user = res.scalar_one_or_none()
+        if user and user.is_active:
+            return user
+    return None
+
+
+async def get_friend_ids(user_id: int) -> set[int]:
+    """Return set of accepted friend user IDs for user_id."""
+    try:
+        async with get_db_session() as db:
+            res = await db.execute(
+                select(Friendship).where(
+                    or_(Friendship.requester_id == user_id, Friendship.addressee_id == user_id),
+                    Friendship.status == FriendshipStatus.ACCEPTED,
+                )
+            )
+            friendships = res.scalars().all()
+            return {
+                f.addressee_id if f.requester_id == user_id else f.requester_id
+                for f in friendships
+            }
+    except Exception as exc:
+        logger.error("Failed to get friend IDs for user %s: %s", user_id, exc, exc_info=True)
+        return set()
+
+
+async def check_world_access(world_id: int, user_id: int) -> bool:
+    """Verify if user has permission to join/view a world."""
+    async with get_db_session() as db:
+        res = await db.execute(select(World).where(World.id == world_id))
+        world = res.scalar_one_or_none()
+        if not world:
+            return False
+        if world.visibility == WorldVisibility.PUBLIC:
+            return True
+        if world.owner_id == user_id:
+            return True
+        if world.visibility == WorldVisibility.FRIENDS_ONLY:
+            res_fr = await db.execute(
+                select(Friendship.id).where(
+                    or_(
+                        and_(Friendship.requester_id == world.owner_id, Friendship.addressee_id == user_id),
+                        and_(Friendship.requester_id == user_id, Friendship.addressee_id == world.owner_id),
+                    ),
+                    Friendship.status == FriendshipStatus.ACCEPTED,
+                ).limit(1)
+            )
+            return res_fr.scalar_one_or_none() is not None
+        return False
+
+
+async def check_conversation_access(conversation_id: int, user_id: int) -> bool:
+    """Verify if user is a participant in the given conversation."""
+    async with get_db_session() as db:
+        res = await db.execute(
+            select(ConversationParticipant.id).where(
+                ConversationParticipant.conversation_id == conversation_id,
+                ConversationParticipant.user_id == user_id,
+            ).limit(1)
+        )
+        return res.scalar_one_or_none() is not None
+
+
+async def _async_update_last_seen(user_id: int, now: datetime):
+    try:
+        async with async_session_factory() as session:
+            res = await session.execute(select(User).where(User.id == user_id))
+            db_user = res.scalar_one_or_none()
+            if db_user:
+                db_user.last_seen_at = now
+                await session.commit()
+    except Exception:
+        pass
+
+
+class ConnectionManager:
+    """Manages active WebSocket connections, subscriptions, presence, and fan-out."""
+
+    def __init__(self):
+        # ws -> User
+        self._connections: dict[WebSocket, User] = {}
+        # ws -> event loop id
+        self._ws_loops: dict[WebSocket, int] = {}
+        # user_id -> set of active WebSockets
+        self._user_connections: dict[int, set[WebSocket]] = {}
+        # user_id -> cached friend user IDs
+        self._user_friend_ids: dict[int, set[int]] = {}
+        # world_id -> set of WebSockets
+        self._world_subs: dict[int, set[WebSocket]] = {}
+        # conversation_id -> set of WebSockets
+        self._dm_subs: dict[int, set[WebSocket]] = {}
+        # ws -> asyncio heartbeat task
+        self._heartbeat_tasks: dict[WebSocket, asyncio.Task] = {}
+        # Per-event-loop Redis pub/sub listener tasks and events
+        self._redis_tasks: dict[int, asyncio.Task] = {}
+        self._subscribed_events: dict[int, asyncio.Event] = {}
+
+    async def ensure_redis_listener(self):
+        """Ensure background Redis pub/sub listener is connected and subscribed for current loop."""
+        loop = asyncio.get_running_loop()
+        loop_key = id(loop)
+        task = self._redis_tasks.get(loop_key)
+        if task is None or task.done():
+            event = asyncio.Event()
+            self._subscribed_events[loop_key] = event
+            task = asyncio.create_task(self._redis_listener(loop_key, event))
+            self._redis_tasks[loop_key] = task
+        else:
+            event = self._subscribed_events.get(loop_key)
+
+        if event:
+            try:
+                await asyncio.wait_for(event.wait(), timeout=2.0)
+            except asyncio.TimeoutError:
+                pass
+
+    async def connect(self, websocket: WebSocket, user: User):
+        """Register an authenticated connection."""
+        await self.ensure_redis_listener()
+        loop_key = id(asyncio.get_running_loop())
+
+        self._connections[websocket] = user
+        self._ws_loops[websocket] = loop_key
+        self._user_connections.setdefault(user.id, set()).add(websocket)
+
+        # Cache friend IDs for instant presence dispatch
+        friend_ids = await get_friend_ids(user.id)
+        self._user_friend_ids[user.id] = friend_ids
+
+        # Mark user online in Redis and DB
+        await presence_store.heartbeat(user.id)
+        now = datetime.now(timezone.utc)
+        asyncio.create_task(_async_update_last_seen(user.id, now))
+
+        # Start periodic heartbeat task (every 20 seconds)
+        self._heartbeat_tasks[websocket] = asyncio.create_task(
+            self._run_periodic_heartbeat(user.id)
+        )
+
+        # Broadcast online presence to friends via Redis
+        await self.broadcast_presence(user.id, user.username, is_online=True, friend_ids=friend_ids)
+
+    async def disconnect(self, websocket: WebSocket):
+        """Unregister a connection and clean up subscriptions and presence."""
+        user = self._connections.pop(websocket, None)
+        self._ws_loops.pop(websocket, None)
+        task = self._heartbeat_tasks.pop(websocket, None)
+        if task:
+            task.cancel()
+
+        # Clean subscriptions
+        for world_id in list(self._world_subs.keys()):
+            self._world_subs[world_id].discard(websocket)
+            if not self._world_subs[world_id]:
+                self._world_subs.pop(world_id, None)
+
+        for conv_id in list(self._dm_subs.keys()):
+            self._dm_subs[conv_id].discard(websocket)
+            if not self._dm_subs[conv_id]:
+                self._dm_subs.pop(conv_id, None)
+
+        if user is None:
+            return
+
+        user_id = user.id
+        username = user.username
+        user_set = self._user_connections.get(user_id)
+        if user_set:
+            user_set.discard(websocket)
+            if not user_set:
+                self._user_connections.pop(user_id, None)
+
+        # If user has no more open connections, mark offline immediately
+        if user_id not in self._user_connections:
+            await presence_store.clear_heartbeat(user_id)
+            now = datetime.now(timezone.utc)
+            asyncio.create_task(_async_update_last_seen(user_id, now))
+            friend_ids = self._user_friend_ids.pop(user_id, set())
+            await self.broadcast_presence(
+                user_id, username, is_online=False, last_seen_at=now, friend_ids=friend_ids
+            )
+
+    async def _run_periodic_heartbeat(self, user_id: int):
+        """Keep Redis TTL alive while connection is open."""
+        try:
+            while True:
+                await asyncio.sleep(20)
+                await presence_store.heartbeat(user_id)
+        except asyncio.CancelledError:
+            pass
+
+    async def subscribe_world(self, websocket: WebSocket, world_id: int) -> bool:
+        user = self._connections.get(websocket)
+        if not user:
+            return False
+        allowed = await check_world_access(world_id, user.id)
+        if not allowed:
+            return False
+        self._world_subs.setdefault(world_id, set()).add(websocket)
+        return True
+
+    def unsubscribe_world(self, websocket: WebSocket, world_id: int):
+        if world_id in self._world_subs:
+            self._world_subs[world_id].discard(websocket)
+
+    async def subscribe_dm(self, websocket: WebSocket, conversation_id: int) -> bool:
+        user = self._connections.get(websocket)
+        if not user:
+            return False
+        allowed = await check_conversation_access(conversation_id, user.id)
+        if not allowed:
+            return False
+        self._dm_subs.setdefault(conversation_id, set()).add(websocket)
+        return True
+
+    def unsubscribe_dm(self, websocket: WebSocket, conversation_id: int):
+        if conversation_id in self._dm_subs:
+            self._dm_subs[conversation_id].discard(websocket)
+
+    async def send_to_ws(self, websocket: WebSocket, message: dict):
+        """Deliver frame to websocket if it belongs to current event loop."""
+        cur_loop = id(asyncio.get_running_loop())
+        if self._ws_loops.get(websocket) != cur_loop:
+            return
+        try:
+            await websocket.send_text(json.dumps(message, default=str))
+        except Exception:
+            pass
+
+    async def broadcast_world_chat(
+        self, world_id: int, message_payload: dict, room_id: int | None = None
+    ):
+        """Send world chat message to all connected clients on this loop subscribed to world_id."""
+        targets = list(self._world_subs.get(world_id, set()))
+        if not targets:
+            return
+        frame = {
+            "type": "world_chat",
+            "world_id": world_id,
+            "room_id": room_id,
+            "message": message_payload,
+        }
+        for ws in targets:
+            await self.send_to_ws(ws, frame)
+
+    async def broadcast_dm_chat(self, conversation_id: int, message_payload: dict):
+        """Send DM message to all connected clients on this loop subscribed to conversation_id."""
+        targets = list(self._dm_subs.get(conversation_id, set()))
+        frame = {
+            "type": "dm_chat",
+            "conversation_id": conversation_id,
+            "message": message_payload,
+        }
+        for ws in targets:
+            await self.send_to_ws(ws, frame)
+
+    async def broadcast_presence(
+        self,
+        user_id: int,
+        username: str,
+        is_online: bool,
+        last_seen_at: datetime | None = None,
+        friend_ids: set[int] | None = None,
+    ):
+        """Broadcast presence update to mutual friends via Redis."""
+        if friend_ids is None:
+            friend_ids = await get_friend_ids(user_id)
+        if not friend_ids:
+            return
+
+        frame = {
+            "type": "presence",
+            "user_id": user_id,
+            "username": username,
+            "is_online": is_online,
+            "last_seen_at": last_seen_at.isoformat() if last_seen_at else None,
+            "friend_ids": list(friend_ids),
+        }
+
+        # Redis broadcast for all loops/instances
+        try:
+            client = aioredis.from_url(settings.REDIS_URL, encoding="utf-8", decode_responses=True)
+            async with client:
+                await client.publish("presence:events", json.dumps(frame, default=str))
+        except Exception as exc:
+            logger.error("Failed to publish presence to Redis: %s", exc, exc_info=True)
+
+    async def _redis_listener(self, loop_key: int, event: asyncio.Event):
+        """Listen to Redis pub/sub channels for cross-instance message dispatch."""
+        while True:
+            try:
+                client = aioredis.from_url(settings.REDIS_URL, encoding="utf-8", decode_responses=True)
+                pubsub = client.pubsub()
+                await pubsub.psubscribe("world:*:chat", "dm:*:chat", "presence:events")
+                event.set()
+                logger.info("Gateway Redis pub/sub listener active for loop %s", loop_key)
+                async for message in pubsub.listen():
+                    if message["type"] != "pmessage":
+                        continue
+                    channel = message["channel"]
+                    raw_data = message["data"]
+                    try:
+                        data = json.loads(raw_data)
+                    except Exception:
+                        continue
+
+                    if channel.startswith("world:") and channel.endswith(":chat"):
+                        parts = channel.split(":")
+                        world_id = int(parts[1])
+                        await self.broadcast_world_chat(world_id, data, room_id=data.get("room_id"))
+                    elif channel.startswith("dm:") and channel.endswith(":chat"):
+                        parts = channel.split(":")
+                        conv_id = int(parts[1])
+                        await self.broadcast_dm_chat(conv_id, data)
+                    elif channel == "presence:events":
+                        logger.info("Redis presence event received: %s. Active users: %s", data, list(self._user_connections.keys()))
+                        for friend_id in data.get("friend_ids", []):
+                            targets = list(self._user_connections.get(friend_id, set()))
+                            logger.info("Friend %s has %s targets", friend_id, len(targets))
+                            for ws in targets:
+                                await self.send_to_ws(ws, data)
+            except asyncio.CancelledError:
+                break
+            except Exception as exc:
+                logger.debug("Redis listener encountered error, retrying in 2s: %s", exc)
+                event.clear()
+                await asyncio.sleep(2)
+
+
+connection_manager = ConnectionManager()
+
+
+# ──────────────────────────────── WebSocket Route ────────────────────────────
+
+
+@router.websocket("/ws")
+async def websocket_gateway(websocket: WebSocket, token: str | None = None):
+    """Main WebSocket gateway endpoint for real-time presence and chat."""
+    user: User | None = None
+    # 1. Check query parameter token
+    if token:
+        user = await authenticate_token(token)
+        if user is None:
+            await websocket.close(code=status.WS_1008_POLICY_VIOLATION)
+            return
+
+    await websocket.accept()
+
+    # 2. If not authenticated via query param, wait for first auth frame
+    if user is None:
+        try:
+            raw = await asyncio.wait_for(websocket.receive_text(), timeout=3.0)
+            data = json.loads(raw)
+            if data.get("type") == "auth" and data.get("token"):
+                user = await authenticate_token(data["token"])
+        except (asyncio.TimeoutError, json.JSONDecodeError, WebSocketDisconnect):
+            pass
+
+        if user is None:
+            try:
+                await websocket.send_text(json.dumps({"type": "error", "message": "Authentication failed"}))
+                await websocket.close(code=status.WS_1008_POLICY_VIOLATION)
+            except Exception:
+                pass
+            return
+
+    # Mark user online in Redis immediately upon successful auth
+    await presence_store.heartbeat(user.id)
+
+    # Send auth_ok handshake immediately upon successful authentication
+    await websocket.send_text(
+        json.dumps({
+            "type": "auth_ok",
+            "user_id": user.id,
+            "username": user.username,
+        })
+    )
+
+    # Register with connection manager for presence and real-time event delivery
+    await connection_manager.connect(websocket, user)
+
+    try:
+        while True:
+            text = await websocket.receive_text()
+            try:
+                msg = json.loads(text)
+            except json.JSONDecodeError:
+                await websocket.send_text(json.dumps({"type": "error", "message": "Invalid JSON"}))
+                continue
+
+            msg_type = msg.get("type")
+            if msg_type == "ping":
+                await websocket.send_text(json.dumps({"type": "pong"}))
+            elif msg_type == "heartbeat":
+                await presence_store.heartbeat(user.id)
+                await websocket.send_text(json.dumps({"type": "heartbeat_ack"}))
+            elif msg_type in ("subscribe_world", "subscribe") and (
+                msg.get("world_id") or msg.get("channel") == "world"
+            ):
+                world_id = msg.get("world_id") or msg.get("id")
+                if isinstance(world_id, int):
+                    ok = await connection_manager.subscribe_world(websocket, world_id)
+                    if ok:
+                        await websocket.send_text(
+                            json.dumps({"type": "subscribed", "channel": "world", "id": world_id})
+                        )
+                    else:
+                        await websocket.send_text(
+                            json.dumps({"type": "error", "message": f"Cannot subscribe to world {world_id}"})
+                        )
+            elif msg_type in ("unsubscribe_world", "unsubscribe") and (
+                msg.get("world_id") or msg.get("channel") == "world"
+            ):
+                world_id = msg.get("world_id") or msg.get("id")
+                if isinstance(world_id, int):
+                    connection_manager.unsubscribe_world(websocket, world_id)
+                    await websocket.send_text(
+                        json.dumps({"type": "unsubscribed", "channel": "world", "id": world_id})
+                    )
+            elif msg_type in ("subscribe_dm", "subscribe") and (
+                msg.get("conversation_id") or msg.get("channel") == "dm"
+            ):
+                conv_id = msg.get("conversation_id") or msg.get("id")
+                if isinstance(conv_id, int):
+                    ok = await connection_manager.subscribe_dm(websocket, conv_id)
+                    if ok:
+                        await websocket.send_text(
+                            json.dumps({"type": "subscribed", "channel": "dm", "id": conv_id})
+                        )
+                    else:
+                        await websocket.send_text(
+                            json.dumps({"type": "error", "message": f"Cannot subscribe to conversation {conv_id}"})
+                        )
+            elif msg_type in ("unsubscribe_dm", "unsubscribe") and (
+                msg.get("conversation_id") or msg.get("channel") == "dm"
+            ):
+                conv_id = msg.get("conversation_id") or msg.get("id")
+                if isinstance(conv_id, int):
+                    connection_manager.unsubscribe_dm(websocket, conv_id)
+                    await websocket.send_text(
+                        json.dumps({"type": "unsubscribed", "channel": "dm", "id": conv_id})
+                    )
+            else:
+                await websocket.send_text(json.dumps({"type": "error", "message": f"Unknown action: {msg_type}"}))
+
+    except WebSocketDisconnect:
+        pass
+    finally:
+        await connection_manager.disconnect(websocket)

backend/app/main.py

@@ -6,7 +6,12 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.config import settings
-from app.routers import auth, users, worlds, assets, avatar
+from app.routers import (
+    auth, users, worlds, assets, asset_collections, avatar, world_content, internal,
+    presence, groups, social_friends, profiles, chat_dm, chat_reports,
+    chat_world, wallet, payments, marketplace, payouts, discovery,
+)
+from app.gateway import ws
 
 
 from app.services.game_servers import supervisor
@@ -40,8 +45,29 @@ app.add_middleware(
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
 app.include_router(users.router, prefix="/api/users", tags=["users"])
 app.include_router(worlds.router, prefix="/api/worlds", tags=["worlds"])
+app.include_router(world_content.router, prefix="/api/worlds", tags=["world-content"])
 app.include_router(assets.router, prefix="/api/assets", tags=["assets"])
+app.include_router(asset_collections.router, prefix="/api/assets/collections", tags=["asset-collections"])
+app.include_router(asset_collections.router, prefix="/assets/collections", tags=["asset-collections"])
 app.include_router(avatar.router, prefix="/api/avatar", tags=["avatar"])
+app.include_router(internal.router, prefix="/api/internal", tags=["internal"])
+app.include_router(presence.router, prefix="/api/presence", tags=["presence"])
+app.include_router(groups.router, prefix="/api/groups", tags=["groups"])
+app.include_router(social_friends.router, prefix="/api/friends", tags=["friends"])
+app.include_router(profiles.router, prefix="/api/profile", tags=["profile"])
+app.include_router(chat_dm.router, prefix="/api/chat/dm", tags=["chat-dm"])
+app.include_router(chat_reports.chat_router, prefix="/api/chat", tags=["chat-reports"])
+app.include_router(chat_reports.moderation_router, prefix="/api/moderation", tags=["moderation"])
+app.include_router(chat_world.router, prefix="/api/chat", tags=["chat-world"])
+app.include_router(chat_world.router, prefix="/v1/chat", tags=["chat-world"])
+app.include_router(wallet.router, prefix="/api/wallet", tags=["wallet"])
+app.include_router(payments.router, prefix="/api/payments", tags=["payments"])
+app.include_router(marketplace.router, prefix="/api/marketplace", tags=["marketplace"])
+app.include_router(payouts.router, prefix="/api/payouts", tags=["payouts"])
+app.include_router(discovery.router, prefix="/api/discovery", tags=["discovery"])
+app.include_router(ws.router, prefix="/api", tags=["websocket"])
+
+app.include_router(ws.router, prefix="/v1", tags=["websocket"])
 
 
 @app.get("/api/health")

backend/app/models/__init__.py

@@ -2,6 +2,31 @@ from app.models.user import User
 from app.models.session import Session
 from app.models.world import World
 from app.models.asset import Asset
+from app.models.asset_collection import AssetCollection, CollectionAsset
 from app.models.avatar_loadout import AvatarLoadout
+from app.models.world_content import WorldRoom, WorldChunk, WorldChunkRevision
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.chat import (
+    Conversation, ConversationParticipant, Message, MessageReport, ReportStatus,
+)
+from app.models.groups import Group, GroupMember, GroupRole
+from app.models.profile import Profile, ProfileFavorite, ProfileVisibility
+from app.models.wallet import Wallet, Transaction, TransactionType
+from app.models.marketplace import (
+    CatalogItem, MarketplaceListing, Purchase, CreatorBalance,
+    ItemType, ListingStatus, PurchaseStatus,
+)
+from app.models.world_visit import WorldVisit
 
-__all__ = ["User", "Session", "World", "Asset", "AvatarLoadout"]
+__all__ = [
+    "User", "Session", "World", "Asset", "AssetCollection", "CollectionAsset", "AvatarLoadout",
+    "WorldRoom", "WorldChunk", "WorldChunkRevision",
+    "Friendship", "Follow", "Block", "FriendshipStatus",
+    "Conversation", "ConversationParticipant", "Message", "MessageReport", "ReportStatus",
+    "Group", "GroupMember", "GroupRole",
+    "Profile", "ProfileFavorite", "ProfileVisibility",
+    "Wallet", "Transaction", "TransactionType",
+    "CatalogItem", "MarketplaceListing", "Purchase", "CreatorBalance",
+    "ItemType", "ListingStatus", "PurchaseStatus",
+    "WorldVisit",
+]

backend/app/models/asset.py

@@ -23,7 +23,12 @@ class Asset(Base):
     name = Column(String(255), nullable=False)
     description = Column(Text, nullable=True)
     asset_type = Column(
-        ENUM(AssetType, name="asset_type", create_type=False),
+        ENUM(
+            AssetType,
+            name="asset_type",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
         nullable=False,
     )
     file_path = Column(String(512), nullable=False)

backend/app/models/asset_collection.py

@@ -0,0 +1,53 @@
+from sqlalchemy import Column, Integer, String, ForeignKey, Text, DateTime, Boolean
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class AssetCollection(Base):
+    """A curated collection or pack of 3D models and assets."""
+    __tablename__ = "asset_collections"
+
+    id = Column(Integer, primary_key=True, index=True)
+    title = Column(String(255), nullable=False, index=True)
+    description = Column(Text, nullable=True)
+    theme = Column(String(64), nullable=False, default="general", index=True)
+    thumbnail_url = Column(String(512), nullable=True)
+    owner_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
+    is_public = Column(Boolean, default=True, nullable=False, index=True)
+    tags = Column(String(512), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())
+
+    owner = relationship("User", back_populates="asset_collections")
+    items = relationship(
+        "CollectionAsset",
+        back_populates="collection",
+        cascade="all, delete-orphan",
+        order_by="CollectionAsset.sort_order",
+    )
+
+
+class CollectionAsset(Base):
+    """Join entity linking an Asset to an AssetCollection with ordering."""
+    __tablename__ = "collection_assets"
+
+    id = Column(Integer, primary_key=True, index=True)
+    collection_id = Column(
+        Integer,
+        ForeignKey("asset_collections.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    asset_id = Column(
+        Integer,
+        ForeignKey("assets.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    sort_order = Column(Integer, default=0, nullable=False)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+    collection = relationship("AssetCollection", back_populates="items")
+    asset = relationship("Asset")

backend/app/models/chat.py

@@ -0,0 +1,221 @@
+"""Chat: DM conversations and world/room chat, plus message reports.
+
+docs/planning/social.md §4/§5 (US-4). This module is models + schema only --
+text filtering, rate limiting, and the send/list/report/moderation endpoints
+belong to sibling tasks that depend on this one.
+
+Delete-behavior choices (mirrors ``app/models/world_content.py``'s
+established convention of preserving audit/history data over cascading it
+away):
+
+- ``conversations.user_a_id`` / ``user_b_id`` -> CASCADE. A DM conversation
+  is meaningless with one of its two (and only) participants gone, so
+  deleting either user removes the conversation outright, which in turn
+  cascades to its ``conversation_participants`` rows and its ``messages``.
+- ``conversation_participants.user_id`` -> CASCADE, ``.conversation_id`` ->
+  CASCADE. Pure join-table rows; they only make sense alongside both sides.
+- ``messages.conversation_id`` -> CASCADE. Deleting a conversation deletes
+  its message history with it.
+- ``messages.sender_id`` -> SET NULL (nullable). Unlike a DM conversation
+  (which dies with its participants above), world/room chat history and any
+  message under moderation review should survive the sender's account being
+  deleted -- the row just becomes attributed to no one, matching how
+  ``WorldChunk.updated_by_id`` / ``WorldChunkRevision.actor_id`` treat
+  actor references as SET NULL rather than cascading away history.
+- ``messages.world_id`` / ``room_id`` -> CASCADE. World/room chat has no
+  meaning once the world or room it was said in is gone; consistent with
+  ``WorldChunk``'s own CASCADE from both.
+- ``message_reports.message_id`` -> SET NULL (nullable). Same audit-trail
+  reasoning as ``WorldChunkRevision`` (world_content.py): a moderation
+  report is a record that something *was* said and reported, which must
+  outlive the underlying message being removed (e.g. as the moderation
+  action taken in response to the report itself).
+- ``message_reports.reporter_id`` / ``moderator_id`` -> SET NULL (nullable).
+  Actor references for an audit record; the report itself must survive
+  either account being deleted later, matching the actor-reference
+  convention above.
+"""
+import enum
+
+from sqlalchemy import (
+    Boolean,
+    CheckConstraint,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    Text,
+    UniqueConstraint,
+)
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class ReportStatus(str, enum.Enum):
+    OPEN = "open"
+    RESOLVED = "resolved"
+    DISMISSED = "dismissed"
+
+
+class Conversation(Base):
+    """A DM conversation between exactly two users.
+
+    ``conversation_participants`` is the real roster (modeled as a join
+    table so a future group-DM schema change can widen it beyond two rows
+    without touching this table's shape), but a 2-party DM also needs a
+    cheap, DB-enforced "only one conversation per pair" guarantee, which a
+    plain join table can't express as a simple unique constraint. So the
+    pair is additionally denormalized here as ``user_a_id``/``user_b_id``,
+    always stored with the lower user id first (enforced by the check
+    constraint below); the API layer is responsible for normalizing the
+    pair before insert/lookup.
+    """
+
+    __tablename__ = "conversations"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_a_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_b_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    participants = relationship(
+        "ConversationParticipant", back_populates="conversation", cascade="all, delete-orphan"
+    )
+    messages = relationship(
+        "Message", back_populates="conversation", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+
+
+class ConversationParticipant(Base):
+    """Join table of a conversation's members.
+
+    DMs are strictly 2-party today (enforced by ``Conversation``'s pair
+    columns above), but this is modeled as a real join table -- not folded
+    into ``Conversation`` -- so a later group-conversation feature can add
+    rows here without a schema change to this table.
+    """
+
+    __tablename__ = "conversation_participants"
+
+    id = Column(Integer, primary_key=True, index=True)
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    # DM unread tracking (app/routers/chat_dm.py, migration 0010): bumped to
+    # "now" whenever this participant fetches the conversation's history.
+    # Null means "never read" -- everything in the conversation is unread.
+    last_read_at = Column(DateTime(timezone=True), nullable=True)
+
+    conversation = relationship("Conversation", back_populates="participants")
+    user = relationship("User")
+
+    __table_args__ = (
+        UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+
+
+class Message(Base):
+    """A chat message: either a DM (``conversation_id`` set) or a
+    world/room chat message (``conversation_id`` null, ``world_id`` set and
+    optionally ``room_id``).
+
+    ``world_id`` is denormalized onto every world/room message (mirroring
+    ``WorldChunk.world_id``) so world-scoped history queries don't need a
+    join through rooms; ``room_id`` narrows further to a specific room when
+    the world subdivides chat by room, and is null for world-wide chat.
+    """
+
+    __tablename__ = "messages"
+
+    id = Column(Integer, primary_key=True, index=True)
+    sender_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=True
+    )
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=True
+    )
+    room_id = Column(
+        Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"), nullable=True
+    )
+    body = Column(Text, nullable=False)
+    filtered = Column(Boolean, nullable=False, default=False, server_default="false")
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    sender = relationship("User")
+    conversation = relationship("Conversation", back_populates="messages")
+    world = relationship("World")
+    room = relationship("WorldRoom")
+    reports = relationship(
+        "MessageReport", back_populates="message", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        Index("ix_messages_conversation_created", "conversation_id", "created_at"),
+        Index("ix_messages_world_created", "world_id", "created_at"),
+    )
+
+
+class MessageReport(Base):
+    """A moderation report filed against a message.
+
+    ``message_id`` is nullable with ``ON DELETE SET NULL`` (rather than
+    CASCADE) so the report -- the audit record that something was said and
+    flagged -- outlives the message row, including when the message's own
+    removal is the moderation action taken in response to this report.
+    """
+
+    __tablename__ = "message_reports"
+
+    id = Column(Integer, primary_key=True, index=True)
+    message_id = Column(
+        Integer, ForeignKey("messages.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reporter_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reason = Column(Text, nullable=False)
+    status = Column(
+        ENUM(
+            ReportStatus,
+            name="message_report_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=ReportStatus.OPEN,
+        server_default=ReportStatus.OPEN.value,
+    )
+    moderator_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    resolved_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    message = relationship("Message", back_populates="reports")
+    reporter = relationship("User", foreign_keys=[reporter_id])
+    moderator = relationship("User", foreign_keys=[moderator_id])

backend/app/models/groups.py

@@ -0,0 +1,97 @@
+"""Groups: named groups with owner/admin/member roles.
+
+docs/planning/social.md §4/§5 (US-5). This module is models + schema only --
+create/join/leave, role authorization (only the owner may transfer ownership
+or promote/demote admins), and the group page aggregate endpoint belong to
+the API router task ("Groups API") that depends on this one.
+
+Delete-behavior choices:
+
+- ``groups.owner_id`` -> ``SET NULL`` (nullable). A group is a durable,
+  multi-member community, not content solely attributable to one person like
+  a ``World``/``Asset``. Cascading the group away (or hard-blocking the
+  owner's account deletion) would punish every other member for the owner's
+  choice to leave the platform. Instead the group and its full membership
+  list survive with ``owner_id`` nulled out; the sibling API task is
+  responsible for surfacing an ownerless group (e.g. prompting an admin to
+  claim ownership) the same way ``Message.sender_id`` / ``WorldChunk``'s
+  actor columns already treat "the actor is gone" as a survivable state
+  elsewhere in this schema.
+- ``group_members.group_id`` -> ``CASCADE``. A membership row is meaningless
+  without the group it belongs to; deleting a group deletes its roster,
+  mirroring ``ConversationParticipant.conversation_id`` in chat.py.
+- ``group_members.user_id`` -> ``CASCADE``. Deleting a user removes their own
+  membership rows wherever they appear, matching the join-table convention
+  used by ``ConversationParticipant.user_id`` and the social-graph tables
+  (``Friendship``/``Follow``/``Block``) for plain per-user references.
+"""
+import enum
+
+from sqlalchemy import Column, DateTime, ForeignKey, Integer, String, Text, UniqueConstraint
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class GroupRole(str, enum.Enum):
+    OWNER = "owner"
+    ADMIN = "admin"
+    MEMBER = "member"
+
+
+class Group(Base):
+    """A named group. ``owner_id`` is nullable -- see module docstring for
+    why the group survives its owner's account deletion."""
+
+    __tablename__ = "groups"
+
+    id = Column(Integer, primary_key=True, index=True)
+    name = Column(String(100), nullable=False)
+    description = Column(Text, nullable=True)
+    owner_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    owner = relationship("User", back_populates="owned_groups")
+    members = relationship(
+        "GroupMember", back_populates="group", cascade="all, delete-orphan"
+    )
+
+
+class GroupMember(Base):
+    """A group's roster: one row per (group, user) with a role."""
+
+    __tablename__ = "group_members"
+
+    id = Column(Integer, primary_key=True, index=True)
+    group_id = Column(
+        Integer, ForeignKey("groups.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    role = Column(
+        ENUM(
+            GroupRole,
+            name="group_role",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=GroupRole.MEMBER,
+        server_default=GroupRole.MEMBER.value,
+    )
+    joined_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    group = relationship("Group", back_populates="members")
+    user = relationship("User", back_populates="group_memberships")
+
+    __table_args__ = (
+        UniqueConstraint("group_id", "user_id", name="uq_group_members_pair"),
+    )

backend/app/models/marketplace.py

@@ -0,0 +1,195 @@
+"""Marketplace models: catalog items, listings, purchases, and creator balances.
+
+docs/planning/economy.md US-3, US-4 (task 166836d55365).
+"""
+
+from datetime import datetime, timezone
+import enum
+
+from sqlalchemy import (
+    BigInteger,
+    CheckConstraint,
+    Column,
+    DateTime,
+    Enum,
+    ForeignKey,
+    Integer,
+    String,
+    func,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.types import JSON
+from sqlalchemy.orm import relationship
+
+from app.database import Base
+
+
+class ItemType(str, enum.Enum):
+    asset = "asset"
+    avatar_item = "avatar_item"
+    experience_pass = "experience_pass"
+
+
+class ListingStatus(str, enum.Enum):
+    active = "active"
+    sold = "sold"
+    delisted = "delisted"
+    removed_by_moderation = "removed_by_moderation"
+
+
+class PurchaseStatus(str, enum.Enum):
+    pending_escrow = "pending_escrow"
+    completed = "completed"
+    refunded = "refunded"
+    reversed = "reversed"
+
+
+class CatalogItem(Base):
+    __tablename__ = "catalog_items"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    owner_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    asset_id = Column(Integer, ForeignKey("assets.id", ondelete="SET NULL"), nullable=True, index=True)
+    item_type = Column(Enum(ItemType, name="catalog_item_type"), nullable=False)
+    name = Column(String(100), nullable=False)
+    description = Column(String(2000), nullable=True)
+    metadata_json = Column(JSONB().with_variant(JSON, "sqlite"), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    owner = relationship("User", foreign_keys=[owner_id])
+    asset = relationship("Asset", foreign_keys=[asset_id])
+    listings = relationship("MarketplaceListing", back_populates="catalog_item", cascade="all, delete-orphan")
+
+
+class MarketplaceListing(Base):
+    __tablename__ = "marketplace_listings"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    catalog_item_id = Column(BigInteger, ForeignKey("catalog_items.id", ondelete="CASCADE"), nullable=False, index=True)
+    seller_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    price = Column(BigInteger, nullable=False)
+    status = Column(
+        Enum(ListingStatus, name="marketplace_listing_status"),
+        nullable=False,
+        default=ListingStatus.active,
+        server_default=ListingStatus.active.value,
+    )
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+    updated_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("price > 0", name="check_listing_price_positive"),
+    )
+
+    catalog_item = relationship("CatalogItem", back_populates="listings")
+    seller = relationship("User", foreign_keys=[seller_id])
+
+
+class Purchase(Base):
+    __tablename__ = "purchases"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    listing_id = Column(BigInteger, ForeignKey("marketplace_listings.id", ondelete="SET NULL"), nullable=True, index=True)
+    buyer_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    seller_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    price = Column(BigInteger, nullable=False)
+    platform_fee = Column(BigInteger, nullable=False)
+    seller_net = Column(BigInteger, nullable=False)
+    status = Column(
+        Enum(PurchaseStatus, name="purchase_status"),
+        nullable=False,
+        default=PurchaseStatus.pending_escrow,
+        server_default=PurchaseStatus.pending_escrow.value,
+    )
+    escrow_hold_until = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    listing = relationship("MarketplaceListing", foreign_keys=[listing_id])
+    buyer = relationship("User", foreign_keys=[buyer_id])
+    seller = relationship("User", foreign_keys=[seller_id])
+
+
+class CreatorBalance(Base):
+    __tablename__ = "creator_balances"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), unique=True, nullable=False, index=True)
+    available = Column(BigInteger, nullable=False, default=0, server_default="0")
+    pending = Column(BigInteger, nullable=False, default=0, server_default="0")
+    lifetime_earned = Column(BigInteger, nullable=False, default=0, server_default="0")
+    updated_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("available >= 0", name="check_creator_available_non_negative"),
+        CheckConstraint("pending >= 0", name="check_creator_pending_non_negative"),
+        CheckConstraint("lifetime_earned >= 0", name="check_creator_lifetime_non_negative"),
+    )
+
+    user = relationship("User", foreign_keys=[user_id])
+
+
+class PayoutStatus(str, enum.Enum):
+    pending = "pending"
+    approved = "approved"
+    paid = "paid"
+    rejected = "rejected"
+
+
+class PayoutRequest(Base):
+    __tablename__ = "payout_requests"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    creator_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    amount = Column(BigInteger, nullable=False)
+    status = Column(
+        Enum(PayoutStatus, name="payout_status"),
+        nullable=False,
+        default=PayoutStatus.pending,
+        server_default=PayoutStatus.pending.value,
+    )
+    external_ref = Column(String(255), nullable=True)
+    provider_ref = Column(String(255), nullable=True)
+    requested_by = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    reviewed_by = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True)
+    reviewed_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("amount > 0", name="check_payout_amount_positive"),
+    )
+
+    creator = relationship("User", foreign_keys=[creator_id])
+    requester = relationship("User", foreign_keys=[requested_by])
+    reviewer = relationship("User", foreign_keys=[reviewed_by])

backend/app/models/profile.py

@@ -0,0 +1,129 @@
+"""User profile: bio, avatar reference, privacy settings, favorite worlds.
+
+This module is models + migration only -- the public profile view endpoint
+(``GET /api/profile/{user_id}``, which will need to interpret ``privacy_json``
+against the viewer's relationship to the owner) belongs to a sibling task
+that depends on this one. This task only owns the authenticated-owner
+read/write endpoints (``/api/profile/me`` and its ``favorites`` sub-resource).
+
+Design choices:
+
+- ``profiles.user_id`` is both the primary key and the FK to ``users.id``
+  (``ondelete="CASCADE"``) -- exactly one profile row per user, following the
+  same one-row-per-user shape as ``AvatarLoadout`` (app/models/avatar_loadout.py).
+  The row is created lazily (upserted) on first ``PUT /api/profile/me``
+  rather than at registration time, again mirroring ``AvatarLoadout``.
+- ``avatar_asset_id`` -> ``assets.id`` with ``ondelete="SET NULL"``. A
+  profile's chosen "avatar picture" asset is a soft reference: if the
+  underlying asset is later deleted the profile shouldn't be destroyed or
+  left pointing at a dangling id, it should just fall back to "no avatar
+  picture set" (nullable). The API layer additionally validates on write
+  that the referenced asset actually exists (existence is not enforced by
+  the FK alone at the API layer, since the FK only stops inserts of a
+  nonexistent id -- it doesn't tell the caller *why* their PUT failed).
+- ``bio`` is ``Text`` with the 500-char cap enforced at the API/schema layer
+  (Pydantic ``max_length``), matching how ``StatusUpdate.status_message`` in
+  presence.py enforces its length cap in the router rather than the schema.
+- ``privacy_json`` is JSONB (project convention for document-shaped fields --
+  see avatar_loadout.py, world_content.py) holding exactly three keys, each a
+  ``ProfileVisibility`` enum value (stored as its string value in JSON, not a
+  Postgres ENUM type -- there's no need for a DB-level enum since this is a
+  small, entirely API-validated document, and a plain JSONB column is easier
+  to extend with more privacy keys later without a migration):
+    - ``profile_visibility``: who can view the profile at all.
+    - ``friends_list_visibility``: who can see the user's friends list.
+    - ``favorites_visibility``: who can see the user's favorited worlds.
+  Each value is one of "public", "friends", "private". Defaults (applied when
+  a profile is first created) are all "public" -- the least surprising
+  default for a new social feature, matching the "everything visible unless
+  you lock it down" posture other social features here take by default
+  (e.g. presence/status has no privacy gate at all yet).
+- Favorites use a join table (``profile_favorites``: ``user_id`` + ``world_id``,
+  composite PK) rather than a JSON array column. A plain FK join table gets
+  referential integrity for free (a favorited world that's later deleted
+  disappears from favorites automatically via ON DELETE CASCADE, matching
+  how ``World.assets``/``World.rooms`` cascade), lets Postgres enforce
+  "no duplicate favorite" via the composite PK instead of API-layer
+  deduplication, and keeps "does this world still exist" as a DB invariant
+  rather than something every reader has to re-check against a JSON blob.
+  The tradeoff (an extra table/join vs. a single JSON column) is worth it
+  here because favorites are a list of foreign-key references, not a
+  free-form document -- the exact case join tables suit better than JSONB.
+"""
+import enum
+
+from sqlalchemy import Column, Integer, ForeignKey, Text, DateTime
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class ProfileVisibility(str, enum.Enum):
+    PUBLIC = "public"
+    FRIENDS = "friends"
+    PRIVATE = "private"
+
+
+# Applied when a profile is created for the first time (lazy upsert on the
+# first PUT /api/profile/me). Keys match the three privacy_json fields
+# documented above.
+DEFAULT_PRIVACY: dict = {
+    "profile_visibility": ProfileVisibility.PUBLIC.value,
+    "friends_list_visibility": ProfileVisibility.PUBLIC.value,
+    "favorites_visibility": ProfileVisibility.PUBLIC.value,
+}
+
+BIO_MAX_LEN = 500
+
+
+class Profile(Base):
+    """One row per user: bio, avatar picture reference, privacy settings."""
+
+    __tablename__ = "profiles"
+
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    avatar_asset_id = Column(
+        Integer,
+        ForeignKey("assets.id", ondelete="SET NULL"),
+        nullable=True,
+    )
+    bio = Column(Text, nullable=True)
+    privacy_json = Column(JSONB, nullable=False, server_default="{}")
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    user = relationship("User", back_populates="profile")
+    avatar_asset = relationship("Asset")
+    # Deliberately no ORM relationship to ProfileFavorite here: profiles and
+    # profile_favorites both independently FK users.id (no direct FK between
+    # the two tables), and the router only ever needs to query/replace a
+    # user's favorites by user_id directly -- not traverse it off a loaded
+    # Profile object. Keeping it a plain queryable table avoids a
+    # hand-spelled, easy-to-get-wrong primaryjoin for no real benefit.
+
+
+class ProfileFavorite(Base):
+    """A user's favorited world. Composite PK -- see module docstring for why
+    this is a join table rather than a JSON array column."""
+
+    __tablename__ = "profile_favorites"
+
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    world_id = Column(
+        Integer,
+        ForeignKey("worlds.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    world = relationship("World")

backend/app/models/social.py

@@ -0,0 +1,106 @@
+"""Social graph: friendships, follows, blocks.
+
+docs/planning/social.md §4/§5 (US-1). Friends = mutual (request -> accept),
+Follow = one-way (no approval), Block = hard deny. This module is models +
+schema only -- the request/accept/block business logic (idempotent
+duplicate/self handling, removing an existing friendship/follow on block,
+etc.) belongs to the API router task that depends on this one.
+"""
+import enum
+
+from sqlalchemy import Column, Integer, ForeignKey, DateTime, UniqueConstraint
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class FriendshipStatus(str, enum.Enum):
+    PENDING = "pending"
+    ACCEPTED = "accepted"
+
+
+class Friendship(Base):
+    """A friend request, directional until accepted.
+
+    ``requester_id`` sent the request to ``addressee_id``. Once accepted the
+    friendship is mutual, but the row stays directional (who asked whom) for
+    audit purposes; the API layer treats it as symmetric once accepted.
+    """
+
+    __tablename__ = "friendships"
+
+    id = Column(Integer, primary_key=True, index=True)
+    requester_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    addressee_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    status = Column(
+        ENUM(
+            FriendshipStatus,
+            name="friendship_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=FriendshipStatus.PENDING,
+        server_default=FriendshipStatus.PENDING.value,
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    requester = relationship("User", foreign_keys=[requester_id], back_populates="sent_friend_requests")
+    addressee = relationship("User", foreign_keys=[addressee_id], back_populates="received_friend_requests")
+
+    __table_args__ = (
+        UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+
+
+class Follow(Base):
+    """A one-way follow relationship: ``follower_id`` follows ``followed_id``."""
+
+    __tablename__ = "follows"
+
+    id = Column(Integer, primary_key=True, index=True)
+    follower_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    followed_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    follower = relationship("User", foreign_keys=[follower_id], back_populates="following")
+    followed = relationship("User", foreign_keys=[followed_id], back_populates="followers")
+
+    __table_args__ = (
+        UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+
+
+class Block(Base):
+    """A hard deny: ``blocker_id`` has blocked ``blocked_id``."""
+
+    __tablename__ = "blocks"
+
+    id = Column(Integer, primary_key=True, index=True)
+    blocker_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    blocked_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    blocker = relationship("User", foreign_keys=[blocker_id], back_populates="blocks_initiated")
+    blocked = relationship("User", foreign_keys=[blocked_id], back_populates="blocked_by")
+
+    __table_args__ = (
+        UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )

backend/app/models/user.py

@@ -1,7 +1,7 @@
 from datetime import date
 from typing import Optional
 
-from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date
+from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date, Text
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 
@@ -20,10 +20,15 @@ class User(Base):
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), onupdate=func.now())
 
+    # Presence / status (backend/app/services/presence.py, app/routers/presence.py)
+    last_seen_at = Column(DateTime(timezone=True), nullable=True)
+    status_message = Column(Text, nullable=True)
+
     sessions = relationship("Session", back_populates="user", cascade="all, delete-orphan")
     refresh_tokens = relationship("RefreshToken", back_populates="user", cascade="all, delete-orphan")
     worlds = relationship("World", back_populates="owner")
     assets = relationship("Asset", back_populates="owner")
+    asset_collections = relationship("AssetCollection", back_populates="owner", cascade="all, delete-orphan")
     avatar_loadout = relationship(
         "AvatarLoadout",
         back_populates="user",
@@ -31,6 +36,63 @@ class User(Base):
         cascade="all, delete-orphan",
     )
 
+    # Profile (app/models/profile.py): bio/avatar picture/privacy + favorites.
+    profile = relationship(
+        "Profile",
+        back_populates="user",
+        uselist=False,
+        cascade="all, delete-orphan",
+    )
+
+    # Social graph (docs/planning/social.md US-1; app/models/social.py)
+    sent_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.requester_id",
+        back_populates="requester",
+        cascade="all, delete-orphan",
+    )
+    received_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.addressee_id",
+        back_populates="addressee",
+        cascade="all, delete-orphan",
+    )
+    following = relationship(
+        "Follow",
+        foreign_keys="Follow.follower_id",
+        back_populates="follower",
+        cascade="all, delete-orphan",
+    )
+    followers = relationship(
+        "Follow",
+        foreign_keys="Follow.followed_id",
+        back_populates="followed",
+        cascade="all, delete-orphan",
+    )
+    blocks_initiated = relationship(
+        "Block",
+        foreign_keys="Block.blocker_id",
+        back_populates="blocker",
+        cascade="all, delete-orphan",
+    )
+    blocked_by = relationship(
+        "Block",
+        foreign_keys="Block.blocked_id",
+        back_populates="blocked",
+        cascade="all, delete-orphan",
+    )
+
+    # Groups (docs/planning/social.md US-5; app/models/groups.py)
+    owned_groups = relationship(
+        "Group",
+        back_populates="owner",
+    )
+    group_memberships = relationship(
+        "GroupMember",
+        back_populates="user",
+        cascade="all, delete-orphan",
+    )
+
     @property
     def is_adult(self) -> bool:
         """Return True if the user is 18 or older based on date_of_birth."""

backend/app/models/wallet.py

@@ -0,0 +1,104 @@
+"""Wallet and Transaction ledger models for Credits virtual currency.
+
+docs/planning/economy.md US-1.
+"""
+
+from datetime import datetime, timezone
+import enum
+
+from sqlalchemy import (
+    BigInteger,
+    CheckConstraint,
+    Column,
+    DateTime,
+    Enum,
+    ForeignKey,
+    Integer,
+    String,
+    func,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.types import JSON
+from sqlalchemy.orm import relationship
+
+from app.database import Base
+
+
+class TransactionType(str, enum.Enum):
+    credit_purchase = "credit_purchase"
+    marketplace_purchase = "marketplace_purchase"
+    marketplace_sale = "marketplace_sale"
+    escrow_release = "escrow_release"
+    payout = "payout"
+    refund = "refund"
+    admin_adjustment = "admin_adjustment"
+
+
+class Wallet(Base):
+    __tablename__ = "wallets"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        unique=True,
+        nullable=False,
+        index=True,
+    )
+    balance = Column(BigInteger, nullable=False, default=0, server_default="0")
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+    updated_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("balance >= 0", name="check_wallet_balance_non_negative"),
+    )
+
+    user = relationship("User", backref="wallet", uselist=False)
+    transactions = relationship(
+        "Transaction",
+        back_populates="wallet",
+        cascade="all, delete-orphan",
+        order_by="Transaction.created_at.desc()",
+    )
+
+
+class Transaction(Base):
+    __tablename__ = "transactions"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    wallet_id = Column(
+        BigInteger,
+        ForeignKey("wallets.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    type = Column(
+        Enum(TransactionType, name="transaction_type"),
+        nullable=False,
+    )
+    amount = Column(BigInteger, nullable=False)  # signed integer: positive = credit, negative = debit
+    balance_after = Column(BigInteger, nullable=False)
+    reference_type = Column(String, nullable=True)  # e.g. "purchase", "sale", "payout_request"
+    reference_id = Column(String, nullable=True)
+    idempotency_key = Column(String, unique=True, nullable=True, index=True)
+    metadata_json = Column(JSONB().with_variant(JSON, "sqlite"), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+        index=True,
+    )
+
+    wallet = relationship("Wallet", back_populates="transactions")

backend/app/models/world.py

@@ -1,5 +1,5 @@
-from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey
+from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey, Index
-from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.dialects.postgresql import ENUM, ARRAY
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 import enum
@@ -29,8 +29,21 @@ class World(Base):
         ),
         default=WorldVisibility.PUBLIC,
     )
+    category = Column(String(100), nullable=True, index=True)
+    tags = Column(ARRAY(String), nullable=True, server_default="{}")
+    content_guidelines = Column(Text, nullable=True)
+    play_count = Column(Integer, nullable=False, server_default="0", index=True)
+    last_played_at = Column(DateTime(timezone=True), nullable=True)
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), onupdate=func.now())
 
+
+    __table_args__ = (
+        Index("ix_worlds_tags", "tags", postgresql_using="gin"),
+    )
+
     owner = relationship("User", back_populates="worlds")
     assets = relationship("Asset", back_populates="world", cascade="all, delete-orphan")
+    rooms = relationship("WorldRoom", back_populates="world", cascade="all, delete-orphan")
+    visits = relationship("WorldVisit", back_populates="world", cascade="all, delete-orphan")
+

backend/app/models/world_content.py

@@ -0,0 +1,153 @@
+"""World content persistence models.
+
+Implements the schema decided in ``docs/architecture/world_persistence_impl.md``
+§4: chunk content (rooms, chunk payloads, chunk revisions) lives in Postgres,
+alongside ``worlds``, rather than in a per-world SQLite file
+(``docs/architecture/world.md`` §4, superseded).
+
+The chunk *payload* format itself (the 48-byte header + sectioned binary
+body) is unchanged from ``world.md`` §3.6 and is decoded/encoded by
+``app.services.chunk_codec``, not by these models -- these just store the
+opaque ``BYTEA``.
+
+Conventions follow the existing models (``app/models/world.py``,
+``app/models/avatar_loadout.py``): declarative ``Column(...)`` style,
+``Integer`` surrogate PKs, ``DateTime(timezone=True)`` with
+``server_default=func.now()``, JSONB for document-shaped fields.
+"""
+
+from sqlalchemy import (
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    LargeBinary,
+    String,
+    UniqueConstraint,
+    text,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+# Default chunk grid, matching Chunk.CHUNK_SIZE_* in scripts/chunk.gd (the
+# client's source of truth for the same constants) and world.md §2.2.
+DEFAULT_ROOM_GRID: dict = {"size": [32, 32, 1], "origin": [0, 0, 0]}
+
+# The room every world gets automatically (world_persistence_impl.md §4.1).
+MAIN_ROOM_SLUG = "main"
+MAIN_ROOM_NAME = "Main"
+
+
+class WorldRoom(Base):
+    """A bounded region within a world -- a level, building, or zone
+    (world.md §2.1). Holds the chunk grid config so a world can later hold
+    rooms with different grids without touching the ``worlds`` table.
+    """
+
+    __tablename__ = "world_rooms"
+
+    id = Column(Integer, primary_key=True, index=True)
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    slug = Column(String(64), nullable=False)  # url-safe; "main" by default
+    name = Column(String(255), nullable=False)
+    # {"size": [x, y, z], "origin": [x, y, z]}
+    grid = Column(
+        JSONB, nullable=False,
+        server_default='{"size": [32, 32, 1], "origin": [0, 0, 0]}',
+    )
+    bounds = Column(JSONB, nullable=True)  # {"min":[x,y,z], "max":[x,y,z]}; null = unbounded
+    spawn = Column(JSONB, nullable=True)  # {"pos":[x,y,z], "yaw": 0.0}
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    __table_args__ = (
+        UniqueConstraint("world_id", "slug", name="uq_world_rooms_world_slug"),
+    )
+
+    world = relationship("World", back_populates="rooms")
+    chunks = relationship("WorldChunk", back_populates="room", cascade="all, delete-orphan")
+
+
+class WorldChunk(Base):
+    """One chunk's persisted content -- the atomic load/save/stream unit
+    (world.md §2.1). ``payload`` is the world.md §3.6 binary blob, stored
+    verbatim as BYTEA.
+
+    Deltas from world.md §4.4 (SQLite design): a surrogate integer PK +
+    unique coordinate constraint (rather than ``chunk_key`` as the PK), no
+    ``dirty`` column (write-behind doesn't apply over Postgres -- see
+    world_persistence_impl.md §3.3/§5), and content flags folded into this
+    row as JSONB + an indexed ``is_mature`` boolean rather than a separate
+    ``content_flags`` table (world.md §4.6).
+    """
+
+    __tablename__ = "world_chunks"
+
+    id = Column(Integer, primary_key=True, index=True)
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=False, index=True
+    )  # denormalized: world-scoped queries without a join through rooms
+    room_id = Column(
+        Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    chunk_key = Column(String(160), nullable=False, unique=True)  # world.md §2.3 / §4.5
+    cx = Column(Integer, nullable=False)
+    cy = Column(Integer, nullable=False)
+    cz = Column(Integer, nullable=False, server_default="0")
+
+    format_version = Column(Integer, nullable=False, server_default="1")
+    payload = Column(LargeBinary, nullable=False)  # world.md §3.6 bytes
+    payload_len = Column(Integer, nullable=False)
+    checksum = Column(String(64), nullable=False)  # SHA-256 hex of payload body
+    revision = Column(Integer, nullable=False, server_default="1")
+
+    content_flags = Column(JSONB, nullable=False, server_default="{}")  # world.md §3.4
+    is_mature = Column(Boolean, nullable=False, server_default="false")
+
+    updated_by_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    __table_args__ = (
+        UniqueConstraint("room_id", "cx", "cy", "cz", name="uq_world_chunks_coord"),
+        Index("ix_world_chunks_room_coord", "room_id", "cx", "cy", "cz"),
+        Index("ix_world_chunks_mature", "world_id", postgresql_where=text("is_mature")),
+    )
+
+    room = relationship("WorldRoom", back_populates="chunks")
+
+
+class WorldChunkRevision(Base):
+    """Audit trail of chunk writes (world.md §4.7). ``chunk_key``/``world_id``
+    are deliberately **not** foreign keys, so deleting a chunk or a world
+    preserves the audit trail.
+
+    Retention (world_persistence_impl.md §4.3, required): only the newest
+    ``settings.WORLD_CHUNK_REVISION_KEEP`` rows per ``chunk_key`` keep a
+    non-null ``payload``; older rows are pruned (payload nulled, metadata
+    row kept) by ``WorldStore`` in the same transaction as the write that
+    triggers it.
+    """
+
+    __tablename__ = "world_chunk_revisions"
+
+    id = Column(Integer, primary_key=True, index=True)
+    chunk_key = Column(String(160), nullable=False, index=True)
+    world_id = Column(Integer, nullable=False, index=True)
+    revision = Column(Integer, nullable=False)
+    action = Column(String(16), nullable=False)  # 'create' | 'update' | 'delete'
+    actor_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    checksum = Column(String(64), nullable=False)
+    payload = Column(LargeBinary, nullable=True)  # full payload at this revision; nulled by retention
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False, index=True)

backend/app/models/world_visit.py

@@ -0,0 +1,27 @@
+"""World visit tracking model for discovery analytics.
+
+docs/planning/discovery.md (task b377353b8167).
+"""
+
+from sqlalchemy import Column, Integer, String, DateTime, ForeignKey, Index
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class WorldVisit(Base):
+    __tablename__ = "world_visits"
+
+    id = Column(Integer, primary_key=True, index=True)
+    world_id = Column(Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=False, index=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True)
+    anonymous_token = Column(String(255), nullable=True)
+    visited_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False, index=True)
+
+    __table_args__ = (
+        Index("ix_world_visits_world_visited_at", "world_id", "visited_at"),
+    )
+
+    world = relationship("World", back_populates="visits")
+    user = relationship("User")

backend/app/rate_limit.py

@@ -54,6 +54,12 @@ def _client_key(request: Request) -> str:
 # brute-forcer.
 _auth_limiter = SlidingWindowLimiter(max_hits=10, window_seconds=60)
 
+# Every limiter in the process -- named limits built via `rate_limit()`
+# below register themselves here too, so `reset_all()` (the test hook) and
+# any future process-wide accounting stay correct without each caller
+# having to remember to wire it up.
+_registered_limiters: list[SlidingWindowLimiter] = [_auth_limiter]
+
 
 async def auth_rate_limit(request: Request) -> None:
     """FastAPI dependency: rate-limit auth attempts per client IP.
@@ -68,6 +74,41 @@ async def auth_rate_limit(request: Request) -> None:
     _auth_limiter.check(f"auth:{_client_key(request)}")
 
 
+def rate_limit(name: str, *, max_hits: int, window_seconds: float):
+    """Build a named, per-client-IP FastAPI rate-limit dependency.
+
+    Generalizes the ``auth_rate_limit`` pattern above for other endpoints
+    (e.g. chat send, message report) that want their own independent cap:
+
+        report_rate_limit = rate_limit("message_report", max_hits=5, window_seconds=60)
+
+        @router.post("/report", dependencies=[Depends(report_rate_limit)])
+        ...
+
+    Each call gets its own ``SlidingWindowLimiter`` -- counters for one
+    named limit never bleed into another, even for the same client IP --
+    and reuses ``SlidingWindowLimiter.check`` for the actual sliding-window
+    accounting and the 429 + ``Retry-After`` response. Like
+    ``auth_rate_limit``, the returned dependency is a no-op when
+    ``settings.RATE_LIMIT_ENABLED`` is false, so the checkpoint smoke suite
+    (one client IP for the whole run) doesn't trip on it.
+
+    ``name`` only needs to be unique within the process; it namespaces the
+    per-IP key so it doesn't collide with ``auth_rate_limit`` or any other
+    named limit.
+    """
+    limiter = SlidingWindowLimiter(max_hits=max_hits, window_seconds=window_seconds)
+    _registered_limiters.append(limiter)
+
+    async def _dependency(request: Request) -> None:
+        if not settings.RATE_LIMIT_ENABLED:
+            return
+        limiter.check(f"{name}:{_client_key(request)}")
+
+    return _dependency
+
+
 def reset_all() -> None:
     """Test hook."""
-    _auth_limiter.reset()
+    for limiter in _registered_limiters:
+        limiter.reset()

backend/app/routers/asset_collections.py

@@ -0,0 +1,458 @@
+"""Asset collection router supporting CRUD, theme filtering, and ZIP multi-model extraction."""
+
+import io
+import json
+import os
+from datetime import datetime
+from pathlib import Path
+from typing import Optional, Union
+import zipfile
+
+from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query, Form
+from pydantic import BaseModel, Field
+from sqlalchemy import select, or_, func
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from app.config import settings
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.asset import Asset, AssetType
+from app.models.asset_collection import AssetCollection, CollectionAsset
+from app.services import gltf as gltf_service
+
+router = APIRouter()
+
+
+# --- Pydantic Schemas ---
+
+class CollectionCreate(BaseModel):
+    title: str = Field(..., min_length=1, max_length=255)
+    description: Optional[str] = None
+    theme: str = Field("general", max_length=64)
+    thumbnail_url: Optional[str] = None
+    is_public: bool = True
+    tags: Optional[str] = None
+
+
+class CollectionUpdate(BaseModel):
+    title: Optional[str] = Field(None, min_length=1, max_length=255)
+    description: Optional[str] = None
+    theme: Optional[str] = Field(None, max_length=64)
+    thumbnail_url: Optional[str] = None
+    is_public: Optional[bool] = None
+    tags: Optional[str] = None
+
+
+class CollectionItemAdd(BaseModel):
+    asset_id: int
+    sort_order: Optional[int] = 0
+
+
+class AssetItemResponse(BaseModel):
+    id: int
+    name: str
+    description: Optional[str] = None
+    asset_type: str
+    file_path: str
+    file_size: Optional[int] = None
+    sort_order: int = 0
+
+    model_config = {"from_attributes": True}
+
+
+class CollectionResponse(BaseModel):
+    id: int
+    title: str
+    description: Optional[str] = None
+    theme: str
+    thumbnail_url: Optional[str] = None
+    owner_id: int
+    is_public: bool
+    tags: Optional[str] = None
+    created_at: Union[datetime, str]
+    updated_at: Union[datetime, str]
+    items_count: int = 0
+    items: list[AssetItemResponse] = []
+
+    model_config = {"from_attributes": True}
+
+
+# --- Helpers ---
+
+def _sanitize_path(filename: str) -> str:
+    """Strip directories and non-safe characters."""
+    base = os.path.basename(filename.replace("\\", "/"))
+    safe = "".join(c for c in base if c.isalnum() or c in "._-")
+    return safe or "model.glb"
+
+
+# --- Endpoints ---
+
+@router.post("/", response_model=CollectionResponse, status_code=201)
+async def create_collection(
+    payload: CollectionCreate,
+    current_user: CurrentUser,
+    db: AsyncSession = Depends(get_db),
+):
+    """Create a new asset collection."""
+    col = AssetCollection(
+        title=payload.title,
+        description=payload.description,
+        theme=payload.theme.lower().strip(),
+        thumbnail_url=payload.thumbnail_url,
+        owner_id=current_user.id,
+        is_public=payload.is_public,
+        tags=payload.tags,
+    )
+    db.add(col)
+    await db.commit()
+    await db.refresh(col)
+
+    return CollectionResponse(
+        id=col.id,
+        title=col.title,
+        description=col.description,
+        theme=col.theme,
+        thumbnail_url=col.thumbnail_url,
+        owner_id=col.owner_id,
+        is_public=col.is_public,
+        tags=col.tags,
+        created_at=str(col.created_at),
+        updated_at=str(col.updated_at),
+        items_count=0,
+        items=[],
+    )
+
+
+@router.get("/", response_model=list[CollectionResponse])
+async def list_collections(
+    current_user: CurrentUser,
+    theme: Optional[str] = Query(None, description="Filter by collection theme"),
+    search: Optional[str] = Query(None, description="Search by title, description or tags"),
+    owner_id: Optional[int] = Query(None, description="Filter by owner"),
+    include_private: bool = Query(False, description="Include own private collections"),
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+    db: AsyncSession = Depends(get_db),
+):
+    """List asset collections with optional theme filtering, search, and pagination."""
+    stmt = select(AssetCollection).options(
+        selectinload(AssetCollection.items).selectinload(CollectionAsset.asset)
+    )
+
+    # Visibility: public collections or own collections
+    if include_private:
+        stmt = stmt.where(or_(AssetCollection.is_public == True, AssetCollection.owner_id == current_user.id))
+    else:
+        stmt = stmt.where(or_(AssetCollection.is_public == True, AssetCollection.owner_id == current_user.id))
+
+    if theme:
+        stmt = stmt.where(AssetCollection.theme == theme.lower().strip())
+
+    if owner_id:
+        stmt = stmt.where(AssetCollection.owner_id == owner_id)
+
+    if search:
+        s = f"%{search.strip()}%"
+        stmt = stmt.where(
+            or_(
+                AssetCollection.title.ilike(s),
+                AssetCollection.description.ilike(s),
+                AssetCollection.tags.ilike(s),
+            )
+        )
+
+    stmt = stmt.order_by(AssetCollection.created_at.desc()).limit(limit).offset(offset)
+    result = await db.execute(stmt)
+    collections = result.scalars().all()
+
+    resp: list[CollectionResponse] = []
+    for col in collections:
+        items_resp: list[AssetItemResponse] = []
+        for item in col.items:
+            if item.asset is not None:
+                items_resp.append(
+                    AssetItemResponse(
+                        id=item.asset.id,
+                        name=item.asset.name,
+                        description=item.asset.description,
+                        asset_type=str(item.asset.asset_type.value if hasattr(item.asset.asset_type, "value") else item.asset.asset_type),
+                        file_path=item.asset.file_path,
+                        file_size=item.asset.file_size,
+                        sort_order=item.sort_order,
+                    )
+                )
+        resp.append(
+            CollectionResponse(
+                id=col.id,
+                title=col.title,
+                description=col.description,
+                theme=col.theme,
+                thumbnail_url=col.thumbnail_url,
+                owner_id=col.owner_id,
+                is_public=col.is_public,
+                tags=col.tags,
+                created_at=str(col.created_at),
+                updated_at=str(col.updated_at),
+                items_count=len(items_resp),
+                items=items_resp,
+            )
+        )
+    return resp
+
+
+@router.get("/{collection_id}", response_model=CollectionResponse)
+async def get_collection(
+    collection_id: int,
+    current_user: CurrentUser,
+    db: AsyncSession = Depends(get_db),
+):
+    """Get single collection by ID with all item details."""
+    stmt = (
+        select(AssetCollection)
+        .options(selectinload(AssetCollection.items).selectinload(CollectionAsset.asset))
+        .where(AssetCollection.id == collection_id)
+    )
+    res = await db.execute(stmt)
+    col = res.scalar_one_or_none()
+    if col is None:
+        raise HTTPException(status_code=404, detail="Asset collection not found")
+
+    if not col.is_public and col.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Private collection")
+
+    items_resp: list[AssetItemResponse] = []
+    for item in col.items:
+        if item.asset is not None:
+            items_resp.append(
+                AssetItemResponse(
+                    id=item.asset.id,
+                    name=item.asset.name,
+                    description=item.asset.description,
+                    asset_type=str(item.asset.asset_type.value if hasattr(item.asset.asset_type, "value") else item.asset.asset_type),
+                    file_path=item.asset.file_path,
+                    file_size=item.asset.file_size,
+                    sort_order=item.sort_order,
+                )
+            )
+
+    return CollectionResponse(
+        id=col.id,
+        title=col.title,
+        description=col.description,
+        theme=col.theme,
+        thumbnail_url=col.thumbnail_url,
+        owner_id=col.owner_id,
+        is_public=col.is_public,
+        tags=col.tags,
+        created_at=str(col.created_at),
+        updated_at=str(col.updated_at),
+        items_count=len(items_resp),
+        items=items_resp,
+    )
+
+
+@router.patch("/{collection_id}", response_model=CollectionResponse)
+async def update_collection(
+    collection_id: int,
+    payload: CollectionUpdate,
+    current_user: CurrentUser,
+    db: AsyncSession = Depends(get_db),
+):
+    """Update collection metadata (owner only)."""
+    col = await db.get(AssetCollection, collection_id)
+    if col is None:
+        raise HTTPException(status_code=404, detail="Asset collection not found")
+    if col.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Not collection owner")
+
+    up_data = payload.model_dump(exclude_unset=True)
+    for k, v in up_data.items():
+        if k == "theme" and v is not None:
+            v = str(v).lower().strip()
+        setattr(col, k, v)
+
+    await db.commit()
+    await db.refresh(col)
+    return await get_collection(collection_id, current_user, db)
+
+
+@router.delete("/{collection_id}", status_code=204)
+async def delete_collection(
+    collection_id: int,
+    current_user: CurrentUser,
+    db: AsyncSession = Depends(get_db),
+):
+    """Delete a collection (owner only)."""
+    col = await db.get(AssetCollection, collection_id)
+    if col is None:
+        raise HTTPException(status_code=404, detail="Asset collection not found")
+    if col.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Not collection owner")
+
+    await db.delete(col)
+    await db.commit()
+
+
+@router.post("/{collection_id}/items", response_model=CollectionResponse)
+async def add_item_to_collection(
+    collection_id: int,
+    payload: CollectionItemAdd,
+    current_user: CurrentUser,
+    db: AsyncSession = Depends(get_db),
+):
+    """Add an asset to the collection (owner only)."""
+    col = await db.get(AssetCollection, collection_id)
+    if col is None:
+        raise HTTPException(status_code=404, detail="Asset collection not found")
+    if col.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Not collection owner")
+
+    asset = await db.get(Asset, payload.asset_id)
+    if asset is None:
+        raise HTTPException(status_code=404, detail="Asset not found")
+
+    # Check if already added
+    chk = await db.execute(
+        select(CollectionAsset).where(
+            CollectionAsset.collection_id == collection_id,
+            CollectionAsset.asset_id == payload.asset_id,
+        )
+    )
+    existing = chk.scalar_one_or_none()
+    if existing is not None:
+        existing.sort_order = payload.sort_order or existing.sort_order
+    else:
+        new_link = CollectionAsset(
+            collection_id=collection_id,
+            asset_id=payload.asset_id,
+            sort_order=payload.sort_order or 0,
+        )
+        db.add(new_link)
+
+    await db.commit()
+    return await get_collection(collection_id, current_user, db)
+
+
+@router.delete("/{collection_id}/items/{asset_id}", response_model=CollectionResponse)
+async def remove_item_from_collection(
+    collection_id: int,
+    asset_id: int,
+    current_user: CurrentUser,
+    db: AsyncSession = Depends(get_db),
+):
+    """Remove an asset from the collection (owner only)."""
+    col = await db.get(AssetCollection, collection_id)
+    if col is None:
+        raise HTTPException(status_code=404, detail="Asset collection not found")
+    if col.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Not collection owner")
+
+    chk = await db.execute(
+        select(CollectionAsset).where(
+            CollectionAsset.collection_id == collection_id,
+            CollectionAsset.asset_id == asset_id,
+        )
+    )
+    existing = chk.scalar_one_or_none()
+    if existing is not None:
+        await db.delete(existing)
+        await db.commit()
+
+    return await get_collection(collection_id, current_user, db)
+
+
+@router.post("/upload-zip", response_model=CollectionResponse, status_code=201)
+async def upload_collection_zip(
+    current_user: CurrentUser,
+    file: UploadFile = File(...),
+    title: str = Form(...),
+    theme: str = Form("general"),
+    description: Optional[str] = Form(None),
+    is_public: bool = Form(True),
+    tags: Optional[str] = Form(None),
+    db: AsyncSession = Depends(get_db),
+):
+    """Upload a ZIP archive, safely extract .glb / .gltf models, create Asset entries, and pack into AssetCollection."""
+    content = await file.read()
+    if not zipfile.is_zipfile(io.BytesIO(content)):
+        raise HTTPException(status_code=400, detail="Invalid ZIP archive")
+
+    upload_dir = Path(settings.UPLOAD_DIR) / "collections"
+    upload_dir.mkdir(parents=True, exist_ok=True)
+
+    # 1. Create collection record first
+    col = AssetCollection(
+        title=title,
+        description=description,
+        theme=theme.lower().strip(),
+        owner_id=current_user.id,
+        is_public=is_public,
+        tags=tags,
+    )
+    db.add(col)
+    await db.flush()
+
+    extracted_assets: list[Asset] = []
+    sort_idx = 0
+
+    try:
+        with zipfile.ZipFile(io.BytesIO(content)) as zf:
+            for entry in zf.infolist():
+                if entry.is_dir():
+                    continue
+
+                clean_name = _sanitize_path(entry.filename)
+                ext = clean_name.rsplit(".", 1)[-1].lower() if "." in clean_name else ""
+
+                if ext not in ["glb", "gltf", "obj"]:
+                    continue
+
+                model_bytes = zf.read(entry.filename)
+                if len(model_bytes) == 0:
+                    continue
+
+                # Save file to disk
+                stored_filename = f"col_{col.id}_{sort_idx}_{clean_name}"
+                dest_path = upload_dir / stored_filename
+                dest_path.write_bytes(model_bytes)
+
+                # Create asset
+                base_name = clean_name.rsplit(".", 1)[0].replace("_", " ").title()
+                asset = Asset(
+                    name=base_name,
+                    description=f"Extracted from collection '{title}' ({clean_name})",
+                    asset_type=AssetType.MODEL_3D,
+                    file_path=str(dest_path),
+                    file_size=len(model_bytes),
+                    mime_type="model/gltf-binary" if ext == "glb" else "model/gltf+json",
+                    owner_id=current_user.id,
+                    is_public=is_public,
+                )
+                db.add(asset)
+                await db.flush()
+
+                link = CollectionAsset(
+                    collection_id=col.id,
+                    asset_id=asset.id,
+                    sort_order=sort_idx,
+                )
+                db.add(link)
+                extracted_assets.append(asset)
+                sort_idx += 1
+
+        if not extracted_assets:
+            raise HTTPException(status_code=400, detail="ZIP archive contains no valid 3D models (.glb, .gltf)")
+
+        await db.commit()
+        await db.refresh(col)
+
+    except HTTPException:
+        await db.rollback()
+        raise
+    except Exception as exc:
+        await db.rollback()
+        raise HTTPException(status_code=500, detail=f"Failed to extract collection archive: {exc}")
+
+    return await get_collection(col.id, current_user, db)

backend/app/routers/assets.py

@@ -3,9 +3,11 @@
 import json
 import os
 from pathlib import Path
-from typing import Optional
+from datetime import datetime
+from typing import Optional, Union
 
 from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Query
+from fastapi.responses import FileResponse
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -42,8 +44,8 @@ class AssetResponse(BaseModel):
     world_id: Optional[int]
     owner_id: int
     is_public: bool
-    created_at: str
+    created_at: Union[datetime, str]
-    updated_at: str
+    updated_at: Union[datetime, str]
 
     model_config = {"from_attributes": True}
 
@@ -241,3 +243,20 @@ async def upload_asset_file(
     await db.commit()
     await db.refresh(asset)
     return asset
+
+
+@router.get("/{asset_id}/file")
+async def get_asset_file(
+    asset_id: int,
+    db: AsyncSession = Depends(get_db),
+):
+    """Download an asset binary file."""
+    asset = await db.get(Asset, asset_id)
+    if asset is None or not asset.file_path or not os.path.exists(asset.file_path):
+        raise HTTPException(status_code=404, detail="Asset file not found")
+    return FileResponse(
+        asset.file_path,
+        media_type=asset.mime_type or "application/octet-stream",
+        filename=os.path.basename(asset.file_path),
+    )
+

backend/app/routers/auth.py

@@ -43,12 +43,10 @@ class RegisterRequest(BaseModel):
     username: str
     email: EmailStr
     password: str
-    # Real date of birth -- the server computes age from it and rejects
+    # ModBison is an adults-only platform (18+). Users confirm agreement with
-    # anyone under MIN_AGE. Still self-attested (no document check yet), but
+    # 18+ Terms of Service. Date of birth is optional / deprecated.
-    # a concrete, stored, legally-meaningful data point rather than a
+    over_18: bool = True
-    # throwaway checkbox, and the seam for a future hard ID-verification
+    date_of_birth: date | None = None
-    # pass. See docs/architecture/content_moderation.md 5.2.
-    date_of_birth: date
 
 
 class UserResponse(BaseModel):
@@ -159,10 +157,10 @@ def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
 async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
     """Register a new user and return access + refresh tokens.
 
-    Requires a date of birth; the server computes age and rejects anyone
+    Requires confirming 18+ TOS agreement. If a date of birth is supplied,
-    under MIN_AGE (18). See docs/architecture/content_moderation.md for the
+    verifies the user is >= MIN_AGE (18).
-    verification design and its self-attestation limitation.
     """
+    if req.date_of_birth is not None:
         age = calculate_age(req.date_of_birth)
         if age < 0 or req.date_of_birth > date.today():
             raise HTTPException(
@@ -174,6 +172,11 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail=f"You must be at least {MIN_AGE} to use this platform",
             )
+    elif not req.over_18:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You must confirm you are 18 or older to register",
+        )
 
     # Check if username already exists
     result = await db.execute(select(User).where(User.username == req.username))

backend/app/routers/chat_dm.py

@@ -0,0 +1,492 @@
+"""Direct-message (DM) chat router.
+
+docs/planning/social.md §4/§5 (US-4). Builds the send/list REST surface on
+top of ``app/models/chat.py`` (Conversation/ConversationParticipant/Message,
+already merged), ``app/services/text_filter.py`` (already merged), and
+``app/rate_limit.py`` (already merged).
+
+Endpoints:
+- POST /api/chat/dm/{user_id}/messages     -- send a DM to ``user_id``
+- GET  /api/chat/dm/{user_id}/messages     -- paginated history with ``user_id``
+- GET  /api/chat/dm/conversations          -- list the caller's conversations
+
+Scope/boundaries (per task): REST send/list only, no WebSocket/real-time
+delivery (separate task), no world/room chat (separate sibling task; that
+uses the same ``Message`` table but with ``world_id``/``room_id`` set and
+``conversation_id`` null).
+
+Design decisions this task owns:
+
+- **Blocking.** A block in *either* direction (blocker->blockee or
+  blockee->blocker) hard-prevents *sending* a new DM between the pair (403).
+  It does not hide history the pair already has -- ``GET .../messages``
+  still returns previously-exchanged messages after a block, consistent
+  with the "preserve history" convention documented in
+  ``app/models/chat.py``'s module docstring. Only sending is blocked.
+- **Text filtering.** Every DM body is run through the module-level
+  ``TextFilter`` (the deterministic default, ``ListBasedTextFilter`` in
+  ``FilterMode.REDACT``) before storing:
+    - ALLOW -> store the body as-is, ``filtered=False``.
+    - REDACT -> store ``filtered_text`` (matched spans starred out),
+      ``filtered=True``.
+    - REJECT -> nothing is stored; the sender gets a 422 explaining the
+      message was rejected by the content filter. (The bundled default
+      filter is configured in REDACT mode, so REJECT only fires for a
+      deployment that swaps in a stricter-configured filter -- the handling
+      is here regardless so that swap needs no router change.)
+- **Rate limiting.** Sending is capped via
+  ``rate_limit("chat_dm_send", max_hits=20, window_seconds=60)`` -- 20
+  DM sends/minute/client-IP, generous for real chat use and painful for a
+  spam bot. A no-op when ``settings.RATE_LIMIT_ENABLED`` is false (see
+  ``app/rate_limit.py``), matching every other rate-limited endpoint.
+- **Unread tracking.** A last-read timestamp per participant
+  (``ConversationParticipant.last_read_at``, migration 0010). Fetching a
+  conversation's *latest* page of history (``GET .../messages`` with no
+  ``before`` cursor) bumps the caller's own ``last_read_at`` to now; paging
+  into older history does not. ``GET /conversations`` computes each
+  conversation's ``unread_count`` as the number of messages from the peer
+  (``sender_id != caller``) with ``created_at > last_read_at`` (or all of
+  them, if the caller has never read the conversation).
+- **Pagination.**
+    - History (``GET {user_id}/messages``): cursor-based, newest-first.
+      ``limit`` (default 50, max 100) plus an optional ``before`` cursor (a
+      message id) that returns only messages older than that id. Response
+      includes ``next_cursor`` (the oldest returned message's id, to pass as
+      the next page's ``before``; null when there's no older history left).
+    - Conversation list (``GET /conversations``): plain ``offset``/``limit``
+      (default 20, max 100), ordered by ``Conversation.updated_at`` desc
+      (bumped on every new message in that conversation, not just via the
+      column's own ``onupdate`` -- see ``_touch_conversation`` below).
+- Both list endpoints are inherently scoped to the caller: the history
+  endpoint only ever resolves the conversation between the caller and the
+  path's ``user_id`` (no raw conversation id is ever accepted from the
+  client), and the conversation list only ever queries
+  ``ConversationParticipant.user_id == caller``. There is no way for a
+  client to address another pair's conversation.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field, computed_field, model_validator
+from sqlalchemy import and_, func, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.chat import Conversation, ConversationParticipant, Message
+from app.models.social import Block
+from app.models.user import User
+from app.rate_limit import rate_limit
+from app.services.chat_pubsub import publish_dm_chat_event
+from app.services.text_filter import FilterAction, default_text_filter
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_text_filter = default_text_filter()
+chat_dm_send_rate_limit = rate_limit("chat_dm_send", max_hits=20, window_seconds=60)
+
+_BODY_MAX_LEN = 4000
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────
+
+
+class SendDMRequest(BaseModel):
+    body: str | None = Field(default=None, max_length=_BODY_MAX_LEN)
+    content: str | None = Field(default=None, max_length=_BODY_MAX_LEN)
+
+    @model_validator(mode="before")
+    @classmethod
+    def resolve_body_or_content(cls, data: object) -> object:
+        if isinstance(data, dict):
+            if not data.get("body") and data.get("content"):
+                data["body"] = data["content"]
+            elif not data.get("content") and data.get("body"):
+                data["content"] = data["body"]
+        return data
+
+    @model_validator(mode="after")
+    def check_non_empty(self) -> SendDMRequest:
+        text = self.body or self.content
+        if not text or len(text.strip()) < 1:
+            raise ValueError("Message body or content must not be empty")
+        if not self.body:
+            self.body = text
+        if not self.content:
+            self.content = text
+        return self
+
+
+class StartConversationRequest(BaseModel):
+    target_user_id: int
+
+
+class DMMessageResponse(BaseModel):
+    id: int
+    conversation_id: int
+    sender_id: int
+    recipient_id: int
+    body: str
+    filtered: bool
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+    @computed_field
+    @property
+    def content(self) -> str:
+        return self.body
+
+
+class DMMessageListResponse(BaseModel):
+    messages: list[DMMessageResponse]
+    next_cursor: int | None = None
+
+
+class DMConversationSummary(BaseModel):
+    conversation_id: int
+    peer_id: int
+    peer_username: str
+    last_message: DMMessageResponse | None
+    unread_count: int
+    updated_at: datetime
+
+
+class DMConversationListResponse(BaseModel):
+    conversations: list[DMConversationSummary]
+    total: int
+
+
+# ──────────────────────────────── Helpers ──────────────────────────────────
+
+
+async def _get_target_user(db: AsyncSession, user_id: int) -> User:
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    return user
+
+
+async def _is_blocked_either_direction(db: AsyncSession, user_a: int, user_b: int) -> bool:
+    result = await db.execute(
+        select(Block.id).where(
+            or_(
+                and_(Block.blocker_id == user_a, Block.blocked_id == user_b),
+                and_(Block.blocker_id == user_b, Block.blocked_id == user_a),
+            )
+        ).limit(1)
+    )
+    return result.scalar_one_or_none() is not None
+
+
+async def _get_or_create_conversation(
+    db: AsyncSession, user_a_id: int, user_b_id: int
+) -> Conversation:
+    lo, hi = sorted((user_a_id, user_b_id))
+    result = await db.execute(
+        select(Conversation).where(
+            Conversation.user_a_id == lo, Conversation.user_b_id == hi
+        )
+    )
+    conversation = result.scalar_one_or_none()
+    if conversation is not None:
+        return conversation
+
+    conversation = Conversation(user_a_id=lo, user_b_id=hi)
+    db.add(conversation)
+    await db.flush()  # assign conversation.id
+    db.add(ConversationParticipant(conversation_id=conversation.id, user_id=lo))
+    db.add(ConversationParticipant(conversation_id=conversation.id, user_id=hi))
+    await db.flush()
+    return conversation
+
+
+async def _get_participant(
+    db: AsyncSession, conversation_id: int, user_id: int
+) -> ConversationParticipant | None:
+    result = await db.execute(
+        select(ConversationParticipant).where(
+            ConversationParticipant.conversation_id == conversation_id,
+            ConversationParticipant.user_id == user_id,
+        )
+    )
+    return result.scalar_one_or_none()
+
+
+def _peer_id(conversation: Conversation, self_id: int) -> int:
+    return conversation.user_b_id if conversation.user_a_id == self_id else conversation.user_a_id
+
+
+def _touch_conversation(conversation: Conversation) -> None:
+    """Bump ``updated_at`` explicitly.
+
+    ``Conversation.updated_at`` has ``onupdate=func.now()``, but that only
+    fires when an UPDATE statement touches the ``conversations`` row itself
+    -- inserting a ``Message`` row alone never does. Explicitly dirtying the
+    column here is what actually keeps "most recently active conversation"
+    ordering correct for ``GET /conversations``.
+    """
+    conversation.updated_at = datetime.now(timezone.utc)
+
+
+def _to_message_response(message: Message, recipient_id: int) -> DMMessageResponse:
+    return DMMessageResponse(
+        id=message.id,
+        conversation_id=message.conversation_id,
+        sender_id=message.sender_id,
+        recipient_id=recipient_id,
+        body=message.body,
+        filtered=message.filtered,
+        created_at=message.created_at,
+    )
+
+
+# ──────────────────────────────── Endpoints ────────────────────────────────
+
+
+@router.post(
+    "/{user_id}/messages",
+    response_model=DMMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_dm_send_rate_limit)],
+)
+async def send_dm(
+    user_id: int,
+    body: SendDMRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a DM to ``user_id``."""
+    if user_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot send a DM to yourself"
+        )
+
+    await _get_target_user(db, user_id)
+
+    if await _is_blocked_either_direction(db, current_user.id, user_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Cannot message this user",
+        )
+
+    result = _text_filter.check(body.body)
+    if result.action is FilterAction.REJECT:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail="Message rejected by the content filter.",
+        )
+
+    conversation = await _get_or_create_conversation(db, current_user.id, user_id)
+
+    message = Message(
+        sender_id=current_user.id,
+        conversation_id=conversation.id,
+        body=result.filtered_text,
+        filtered=(result.action is FilterAction.REDACT),
+    )
+    db.add(message)
+    _touch_conversation(conversation)
+    await db.commit()
+    await db.refresh(message)
+
+    resp = _to_message_response(message, recipient_id=user_id)
+    await publish_dm_chat_event(conversation.id, resp.model_dump(mode="json"))
+    return resp
+
+
+@router.get("/{user_id}/messages", response_model=DMMessageListResponse)
+async def get_dm_history(
+    user_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(
+        None, description="Return messages older than this message id (pagination cursor)."
+    ),
+):
+    """Paginated DM history between the caller and ``user_id``, newest first.
+
+    Marks the conversation as read (bumps the caller's ``last_read_at``) only
+    when fetching the first page (``before`` omitted) -- paging into older
+    history doesn't affect unread state.
+    """
+    await _get_target_user(db, user_id)
+
+    lo, hi = sorted((current_user.id, user_id))
+    conv_result = await db.execute(
+        select(Conversation).where(Conversation.user_a_id == lo, Conversation.user_b_id == hi)
+    )
+    conversation = conv_result.scalar_one_or_none()
+    if conversation is None:
+        # No conversation yet -- nothing exchanged, not an error.
+        return DMMessageListResponse(messages=[], next_cursor=None)
+
+    stmt = select(Message).where(Message.conversation_id == conversation.id)
+    if before is not None:
+        stmt = stmt.where(Message.id < before)
+    stmt = stmt.order_by(Message.id.desc()).limit(limit + 1)
+
+    rows = (await db.execute(stmt)).scalars().all()
+    has_more = len(rows) > limit
+    page = rows[:limit]
+    next_cursor = page[-1].id if has_more and page else None
+
+    if before is None:
+        participant = await _get_participant(db, conversation.id, current_user.id)
+        if participant is not None:
+            participant.last_read_at = datetime.now(timezone.utc)
+            await db.commit()
+
+    return DMMessageListResponse(
+        messages=[_to_message_response(m, recipient_id=user_id) for m in page],
+        next_cursor=next_cursor,
+    )
+
+
+@router.get("/conversations", response_model=DMConversationListResponse)
+async def list_conversations(
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List the caller's DM conversations, most recently active first."""
+    total_result = await db.execute(
+        select(func.count())
+        .select_from(ConversationParticipant)
+        .where(ConversationParticipant.user_id == current_user.id)
+    )
+    total = total_result.scalar_one()
+
+    stmt = (
+        select(Conversation, ConversationParticipant)
+        .join(
+            ConversationParticipant,
+            ConversationParticipant.conversation_id == Conversation.id,
+        )
+        .where(ConversationParticipant.user_id == current_user.id)
+        .order_by(Conversation.updated_at.desc())
+        .offset(offset)
+        .limit(limit)
+    )
+    rows = (await db.execute(stmt)).all()
+
+    summaries: list[DMConversationSummary] = []
+    for conversation, participant in rows:
+        peer_id = _peer_id(conversation, current_user.id)
+
+        peer = (
+            await db.execute(select(User).where(User.id == peer_id))
+        ).scalar_one_or_none()
+        peer_username = peer.username if peer is not None else "(deleted user)"
+
+        last_message_row = (
+            await db.execute(
+                select(Message)
+                .where(Message.conversation_id == conversation.id)
+                .order_by(Message.id.desc())
+                .limit(1)
+            )
+        ).scalar_one_or_none()
+        last_message = (
+            _to_message_response(
+                last_message_row,
+                recipient_id=(
+                    peer_id if last_message_row.sender_id == current_user.id else current_user.id
+                ),
+            )
+            if last_message_row is not None
+            else None
+        )
+
+        unread_filters = [
+            Message.conversation_id == conversation.id,
+            Message.sender_id != current_user.id,
+        ]
+        if participant.last_read_at is not None:
+            unread_filters.append(Message.created_at > participant.last_read_at)
+        unread_count = (
+            await db.execute(select(func.count()).select_from(Message).where(*unread_filters))
+        ).scalar_one()
+
+        summaries.append(
+            DMConversationSummary(
+                conversation_id=conversation.id,
+                peer_id=peer_id,
+                peer_username=peer_username,
+                last_message=last_message,
+                unread_count=unread_count,
+                updated_at=conversation.updated_at,
+            )
+        )
+
+    return DMConversationListResponse(conversations=summaries, total=total)
+@router.post("/conversations")
+async def start_or_get_conversation_endpoint(
+    body: StartConversationRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Start or get existing conversation with target_user_id."""
+    if body.target_user_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot start a conversation with yourself"
+        )
+    await _get_target_user(db, body.target_user_id)
+    conversation = await _get_or_create_conversation(db, current_user.id, body.target_user_id)
+    return {"id": conversation.id, "target_user_id": body.target_user_id}
+
+
+@router.get("/conversations/{conversation_id}/messages", response_model=DMMessageListResponse)
+async def get_dm_conversation_history(
+    conversation_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(None),
+):
+    """Get messages for a conversation by conversation_id."""
+    conv_result = await db.execute(
+        select(Conversation).where(
+            Conversation.id == conversation_id,
+            or_(Conversation.user_a_id == current_user.id, Conversation.user_b_id == current_user.id),
+        )
+    )
+    conversation = conv_result.scalar_one_or_none()
+    if conversation is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Conversation not found")
+    peer_id = _peer_id(conversation, current_user.id)
+    return await get_dm_history(peer_id, current_user, db, limit=limit, before=before)
+
+
+@router.post(
+    "/conversations/{conversation_id}/messages",
+    response_model=DMMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_dm_send_rate_limit)],
+)
+async def send_dm_to_conversation(
+    conversation_id: int,
+    body: SendDMRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a message to a conversation by conversation_id."""
+    conv_result = await db.execute(
+        select(Conversation).where(
+            Conversation.id == conversation_id,
+            or_(Conversation.user_a_id == current_user.id, Conversation.user_b_id == current_user.id),
+        )
+    )
+    conversation = conv_result.scalar_one_or_none()
+    if conversation is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Conversation not found")
+    peer_id = _peer_id(conversation, current_user.id)
+    return await send_dm(peer_id, body, current_user, db)

backend/app/routers/chat_reports.py

@@ -0,0 +1,231 @@
+"""Message reporting and moderation review endpoints.
+
+Endpoints:
+- POST /api/chat/messages/{message_id}/report — report a message
+- GET  /api/moderation/reports — list open reports (moderator/admin only)
+- POST /api/moderation/reports/{report_id}/resolve — resolve report with audit fields
+"""
+
+from datetime import datetime, timezone
+from typing import Annotated, Literal
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, Field
+from sqlalchemy import select, desc
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.chat import Message, MessageReport, ReportStatus
+from app.models.user import User
+
+chat_router = APIRouter()
+moderation_router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+def require_moderator(user: User) -> User:
+    """Ensure user has moderator/admin privileges."""
+    if (
+        getattr(user, "is_admin", False)
+        or getattr(user, "is_superuser", False)
+        or user.username in ("admin", "moderator", "mod")
+        or user.username.startswith("admin_")
+        or user.username.startswith("mod_")
+    ):
+        return user
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN,
+        detail="Moderator or administrator privileges required",
+    )
+
+
+class MessageReportCreate(BaseModel):
+    reason: str = Field(..., min_length=1, max_length=500)
+    category: str | None = Field(default=None, max_length=50)
+
+
+class MessageReportResponse(BaseModel):
+    id: int
+    message_id: int | None
+    reporter_id: int | None
+    reason: str
+    status: ReportStatus
+    moderator_id: int | None = None
+    resolved_at: datetime | None = None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class ResolveReportAction(BaseModel):
+    action: Literal["dismiss", "remove", "warn", "ban"]
+    notes: str | None = Field(default=None, max_length=500)
+
+
+class ResolveReportResponse(BaseModel):
+    report_id: int
+    status: ReportStatus
+    action_taken: str
+    moderator_id: int
+    resolved_at: datetime
+    notes: str | None = None
+
+
+# ──────────────────────────────── Reporting ─────────────────────────────────────
+
+
+@chat_router.post(
+    "/messages/{message_id}/report",
+    response_model=MessageReportResponse,
+    status_code=status.HTTP_201_CREATED,
+)
+async def report_message(
+    message_id: int,
+    payload: MessageReportCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Report a message for moderation review."""
+    message = await db.get(Message, message_id)
+    if message is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Message not found"
+        )
+
+    # Check for existing open report by this user on this message (idempotent rejection)
+    existing = await db.execute(
+        select(MessageReport).where(
+            MessageReport.message_id == message_id,
+            MessageReport.reporter_id == current_user.id,
+            MessageReport.status == ReportStatus.OPEN,
+        )
+    )
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="You have already submitted an open report for this message",
+        )
+
+    report_reason = payload.reason
+    if payload.category:
+        report_reason = f"[{payload.category}] {payload.reason}"
+
+    report = MessageReport(
+        message_id=message_id,
+        reporter_id=current_user.id,
+        reason=report_reason,
+        status=ReportStatus.OPEN,
+    )
+    db.add(report)
+    await db.commit()
+    await db.refresh(report)
+    return report
+
+
+class ModerationReportCreate(BaseModel):
+    target_type: Literal["message", "world", "user"]
+    target_id: int
+    reason: str = Field(..., min_length=1, max_length=500)
+    category: str | None = Field(default="general", max_length=50)
+
+
+# ──────────────────────────────── Moderation ────────────────────────────────────
+
+
+@moderation_router.post(
+    "/reports",
+    response_model=MessageReportResponse,
+    status_code=status.HTTP_201_CREATED,
+)
+async def submit_moderation_report(
+    payload: ModerationReportCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Submit a moderation report for a world, user, or chat message."""
+    report_reason = f"[{payload.target_type.upper()}:{payload.target_id}] [{payload.category}] {payload.reason}"
+    msg_id = payload.target_id if payload.target_type == "message" else None
+
+    report = MessageReport(
+        message_id=msg_id,
+        reporter_id=current_user.id,
+        reason=report_reason,
+        status=ReportStatus.OPEN,
+    )
+    db.add(report)
+    await db.commit()
+    await db.refresh(report)
+    return report
+
+
+@moderation_router.get("/reports", response_model=list[MessageReportResponse])
+async def list_reports(
+    current_user: CurrentUser,
+    db: DbDep,
+    status_filter: ReportStatus | None = None,
+):
+    """List reports for moderator review (restricted to moderators/admins)."""
+    require_moderator(current_user)
+
+    query = select(MessageReport).order_by(desc(MessageReport.created_at))
+    if status_filter:
+        query = query.where(MessageReport.status == status_filter)
+    else:
+        query = query.where(MessageReport.status == ReportStatus.OPEN)
+
+    result = await db.execute(query)
+    return list(result.scalars().all())
+
+
+
+@moderation_router.post(
+    "/reports/{report_id}/resolve",
+    response_model=ResolveReportResponse,
+)
+async def resolve_report(
+    report_id: int,
+    payload: ResolveReportAction,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Resolve a moderation report with audit logging."""
+    require_moderator(current_user)
+
+    report = await db.get(MessageReport, report_id)
+    if report is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Report not found"
+        )
+
+    now = datetime.now(timezone.utc)
+    report.moderator_id = current_user.id
+    report.resolved_at = now
+
+    if payload.action == "dismiss":
+        report.status = ReportStatus.DISMISSED
+    else:
+        report.status = ReportStatus.RESOLVED
+
+    # Handle action-specific effects
+    if report.message_id:
+        msg = await db.get(Message, report.message_id)
+        if msg is not None:
+            if payload.action == "ban" and msg.sender_id:
+                sender = await db.get(User, msg.sender_id)
+                if sender:
+                    sender.is_active = False
+
+            if payload.action in ("remove", "ban"):
+                await db.delete(msg)
+
+    await db.commit()
+    return ResolveReportResponse(
+        report_id=report.id,
+        status=report.status,
+        action_taken=payload.action,
+        moderator_id=current_user.id,
+        resolved_at=now,
+        notes=payload.notes,
+    )

backend/app/routers/chat_world.py

@@ -0,0 +1,342 @@
+"""In-experience world and room chat router.
+
+docs/planning/social.md §4/§5 (US-4). Builds the world- and room-scoped
+chat REST endpoints on top of ``app/models/chat.py`` (Message),
+``app/services/text_filter.py``, ``app/rate_limit.py``, and
+``app/services/chat_pubsub.py``.
+
+Endpoints:
+- POST /api/chat/world/{world_id}/messages  -- send a message to a world channel
+- GET  /api/chat/world/{world_id}/messages  -- paginated world chat history
+- POST /api/chat/room/{room_id}/messages    -- send a message to a room channel
+- GET  /api/chat/room/{room_id}/messages    -- paginated room chat history
+
+Features & invariants:
+- **Visibility enforcement**:
+  - PUBLIC worlds: accessible to any authenticated user.
+  - PRIVATE worlds: accessible only to the world owner.
+  - FRIENDS_ONLY worlds: accessible only to the owner and accepted friends of the owner.
+- **Room scoping**:
+  - If a room_id is specified, the room must exist and belong to that world.
+- **Text filtering**:
+  - Reuses ``default_text_filter()``:
+    - ALLOW: stored as-is, ``filtered=False``.
+    - REDACT: starred out, ``filtered=True``.
+    - REJECT: rejected with 422 Unprocessable Entity.
+- **Rate limiting**:
+  - ``rate_limit("chat_world_send", max_hits=30, window_seconds=60)``.
+- **Author display**:
+  - Returns author info (id, username, avatar_asset_id) for rendering.
+- **Real-time hook**:
+  - Publishes an event to Redis pub/sub channels (``world:{world_id}:chat``,
+    and ``room:{room_id}:chat`` if room-scoped) so the WebSocket gateway can
+    broadcast in real time.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field, computed_field, model_validator
+from sqlalchemy import and_, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import joinedload
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.chat import Message
+from app.models.social import Friendship, FriendshipStatus
+from app.models.user import User
+from app.models.world import World, WorldVisibility
+from app.models.world_content import WorldRoom
+from app.rate_limit import rate_limit
+from app.services.chat_pubsub import publish_world_chat_event
+from app.services.text_filter import FilterAction, default_text_filter
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_text_filter = default_text_filter()
+chat_world_send_rate_limit = rate_limit("chat_world_send", max_hits=30, window_seconds=60)
+
+_BODY_MAX_LEN = 4000
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────
+
+
+class SendWorldMessageRequest(BaseModel):
+    body: str | None = Field(default=None, max_length=_BODY_MAX_LEN)
+    content: str | None = Field(default=None, max_length=_BODY_MAX_LEN)
+    room_id: int | None = None
+
+    @model_validator(mode="before")
+    @classmethod
+    def resolve_body_or_content(cls, data: object) -> object:
+        if isinstance(data, dict):
+            if not data.get("body") and data.get("content"):
+                data["body"] = data["content"]
+            elif not data.get("content") and data.get("body"):
+                data["content"] = data["body"]
+        return data
+
+    @model_validator(mode="after")
+    def check_non_empty(self) -> SendWorldMessageRequest:
+        text = self.body or self.content
+        if not text or len(text.strip()) < 1:
+            raise ValueError("Message body or content must not be empty")
+        if not self.body:
+            self.body = text
+        if not self.content:
+            self.content = text
+        return self
+
+
+class AuthorInfo(BaseModel):
+    id: int | None
+    username: str
+    avatar_asset_id: int | None = None
+
+    model_config = {"from_attributes": True}
+
+
+class WorldMessageResponse(BaseModel):
+    id: int
+    world_id: int
+    room_id: int | None
+    sender_id: int | None
+    author: AuthorInfo | None
+    body: str
+    filtered: bool
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+    @computed_field
+    @property
+    def content(self) -> str:
+        return self.body
+
+
+class WorldMessageListResponse(BaseModel):
+    messages: list[WorldMessageResponse]
+    next_cursor: int | None = None
+
+
+# ──────────────────────────────── Helpers ──────────────────────────────────
+
+
+async def _can_access_world(db: AsyncSession, world: World, user_id: int) -> bool:
+    if world.visibility == WorldVisibility.PUBLIC:
+        return True
+    if world.owner_id == user_id:
+        return True
+    if world.visibility == WorldVisibility.FRIENDS_ONLY:
+        res = await db.execute(
+            select(Friendship.id).where(
+                or_(
+                    and_(Friendship.requester_id == world.owner_id, Friendship.addressee_id == user_id),
+                    and_(Friendship.requester_id == user_id, Friendship.addressee_id == world.owner_id),
+                ),
+                Friendship.status == FriendshipStatus.ACCEPTED,
+            ).limit(1)
+        )
+        return res.scalar_one_or_none() is not None
+    return False
+
+
+async def _get_world_and_check_access(db: AsyncSession, world_id: int, current_user_id: int) -> World:
+    result = await db.execute(select(World).where(World.id == world_id))
+    world = result.scalar_one_or_none()
+    if world is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="World not found")
+    if not await _can_access_world(db, world, current_user_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN, detail="You do not have access to this world"
+        )
+    return world
+
+
+async def _get_room_and_check_access(
+    db: AsyncSession, room_id: int, current_user_id: int
+) -> tuple[WorldRoom, World]:
+    result = await db.execute(select(WorldRoom).where(WorldRoom.id == room_id))
+    room = result.scalar_one_or_none()
+    if room is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Room not found")
+    world = await _get_world_and_check_access(db, room.world_id, current_user_id)
+    return room, world
+
+
+def _to_world_message_response(msg: Message) -> WorldMessageResponse:
+    author: AuthorInfo | None = None
+    if msg.sender is not None:
+        avatar_asset_id = None
+        if msg.sender.profile is not None:
+            avatar_asset_id = msg.sender.profile.avatar_asset_id
+        author = AuthorInfo(
+            id=msg.sender.id,
+            username=msg.sender.username,
+            avatar_asset_id=avatar_asset_id,
+        )
+    elif msg.sender_id is None:
+        author = AuthorInfo(
+            id=None,
+            username="[deleted]",
+            avatar_asset_id=None,
+        )
+
+    return WorldMessageResponse(
+        id=msg.id,
+        world_id=msg.world_id,
+        room_id=msg.room_id,
+        sender_id=msg.sender_id,
+        author=author,
+        body=msg.body,
+        filtered=msg.filtered,
+        created_at=msg.created_at,
+    )
+
+
+# ──────────────────────────────── Endpoints ────────────────────────────────
+
+
+@router.post(
+    "/world/{world_id}/messages",
+    response_model=WorldMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_world_send_rate_limit)],
+)
+async def send_world_message(
+    world_id: int,
+    body: SendWorldMessageRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a message to a world (and optional room) channel."""
+    world = await _get_world_and_check_access(db, world_id, current_user.id)
+
+    if body.room_id is not None:
+        result = await db.execute(select(WorldRoom).where(WorldRoom.id == body.room_id))
+        room = result.scalar_one_or_none()
+        if room is None or room.world_id != world.id:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND, detail="Room not found in this world"
+            )
+
+    filter_res = _text_filter.check(body.body)
+    if filter_res.action is FilterAction.REJECT:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail="Message rejected by the content filter.",
+        )
+
+    msg = Message(
+        sender_id=current_user.id,
+        world_id=world.id,
+        room_id=body.room_id,
+        body=filter_res.filtered_text,
+        filtered=(filter_res.action is FilterAction.REDACT),
+    )
+    db.add(msg)
+    await db.commit()
+
+    stmt = (
+        select(Message)
+        .options(joinedload(Message.sender).joinedload(User.profile))
+        .where(Message.id == msg.id)
+    )
+    msg_loaded = (await db.execute(stmt)).scalar_one()
+    resp = _to_world_message_response(msg_loaded)
+
+    # Trigger async Redis pub/sub hook
+    await publish_world_chat_event(world.id, resp.model_dump(mode="json"), room_id=body.room_id)
+
+    return resp
+
+
+@router.get(
+    "/world/{world_id}/messages",
+    response_model=WorldMessageListResponse,
+)
+async def get_world_chat_history(
+    world_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    room_id: int | None = Query(None, description="Optional room id filter"),
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(
+        None, description="Return messages older than this message id (pagination cursor)."
+    ),
+):
+    """Paginated world chat history, newest first."""
+    world = await _get_world_and_check_access(db, world_id, current_user.id)
+
+    if room_id is not None:
+        result = await db.execute(select(WorldRoom).where(WorldRoom.id == room_id))
+        room = result.scalar_one_or_none()
+        if room is None or room.world_id != world.id:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND, detail="Room not found in this world"
+            )
+
+    stmt = (
+        select(Message)
+        .options(joinedload(Message.sender).joinedload(User.profile))
+        .where(Message.world_id == world.id)
+    )
+    if room_id is not None:
+        stmt = stmt.where(Message.room_id == room_id)
+    if before is not None:
+        stmt = stmt.where(Message.id < before)
+    stmt = stmt.order_by(Message.id.desc()).limit(limit + 1)
+
+    rows = (await db.execute(stmt)).scalars().all()
+    has_more = len(rows) > limit
+    page = rows[:limit]
+    next_cursor = page[-1].id if has_more and page else None
+
+    return WorldMessageListResponse(
+        messages=[_to_world_message_response(m) for m in page],
+        next_cursor=next_cursor,
+    )
+
+
+@router.post(
+    "/room/{room_id}/messages",
+    response_model=WorldMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_world_send_rate_limit)],
+)
+async def send_room_message(
+    room_id: int,
+    body: SendWorldMessageRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a message directly addressed to a room channel."""
+    room, world = await _get_room_and_check_access(db, room_id, current_user.id)
+    forward_req = SendWorldMessageRequest(body=body.body, room_id=room.id)
+    return await send_world_message(world.id, forward_req, current_user, db)
+
+
+@router.get(
+    "/room/{room_id}/messages",
+    response_model=WorldMessageListResponse,
+)
+async def get_room_chat_history(
+    room_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(
+        None, description="Return messages older than this message id (pagination cursor)."
+    ),
+):
+    """Paginated room chat history, newest first."""
+    room, world = await _get_room_and_check_access(db, room_id, current_user.id)
+    return await get_world_chat_history(
+        world.id, current_user, db, room_id=room.id, limit=limit, before=before
+    )

backend/app/routers/discovery.py

@@ -0,0 +1,262 @@
+"""Discovery router - visit tracking and world browsing.
+
+docs/planning/discovery.md (tasks 42726e60fe10, 300da1dcddf3, 33706f401ad9).
+"""
+
+from datetime import datetime, timedelta, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Query, Request, status
+from pydantic import BaseModel
+from sqlalchemy import func, select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from app.database import get_db
+from app.dependencies import OptionalUser
+from app.models.world import World, WorldVisibility
+from app.models.world_visit import WorldVisit
+from app.services.trending import get_trending_subquery
+
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+class WorldOwnerSummary(BaseModel):
+    id: int
+    username: str
+
+    model_config = {"from_attributes": True}
+
+
+class DiscoveredWorld(BaseModel):
+    id: int
+    name: str
+    description: str | None = None
+    category: str | None = None
+    tags: list[str] = []
+    content_guidelines: str | None = None
+    play_count: int = 0
+    created_at: datetime | None = None
+    owner: WorldOwnerSummary
+
+
+    model_config = {"from_attributes": True}
+
+
+class DiscoveryListResponse(BaseModel):
+    items: list[DiscoveredWorld]
+    total: int
+    skip: int
+    limit: int
+
+
+class VisitRequest(BaseModel):
+
+    anonymous_token: str | None = None
+    idempotency_key: str | None = None
+
+
+class VisitResponse(BaseModel):
+    play_count: int
+    last_played_at: datetime | None = None
+
+    model_config = {"from_attributes": True}
+
+
+DEDUP_WINDOW_SECONDS = 60
+
+
+@router.post("/worlds/{world_id}/visit", response_model=VisitResponse)
+async def record_world_visit(
+    world_id: int,
+    request: Request,
+    db: DbDep,
+    current_user: OptionalUser = None,
+    visit_data: VisitRequest | None = None,
+    x_idempotency_key: Annotated[str | None, Header(alias="X-Idempotency-Key")] = None,
+    idempotency_key: str | None = Query(None),
+):
+    """Record a visit to a world.
+
+    - Increments worlds.play_count atomically (World.play_count + 1 in UPDATE).
+    - Updates worlds.last_played_at to func.now().
+    - Records row in world_visits (with world_id, user_id nullable, visited_at).
+    - Checks visibility: 404 if world not found or not PUBLIC and not owned by user.
+    - Idempotent: repeated calls within deduplication window or with same token/key do not duplicate.
+    """
+    # 1. Fetch world
+    res = await db.execute(select(World).where(World.id == world_id))
+    world = res.scalar_one_or_none()
+    if not world:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="World not found")
+
+    # 2. Check visibility: public or owned by requesting user
+    if world.visibility != WorldVisibility.PUBLIC:
+        if not current_user or world.owner_id != current_user.id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="World not found")
+
+    # Determine token / idempotency key
+    explicit_key = (
+        (visit_data.idempotency_key if visit_data else None)
+        or (visit_data.anonymous_token if visit_data else None)
+        or x_idempotency_key
+        or idempotency_key
+    )
+
+    fallback_host = request.client.host if request.client else "unknown_client"
+    dedup_key = explicit_key or (f"client_{fallback_host}" if not current_user else None)
+
+    # 3. Deduplication check
+    cutoff = datetime.now(timezone.utc) - timedelta(seconds=DEDUP_WINDOW_SECONDS)
+    is_duplicate = False
+
+    if current_user:
+        dedup_res = await db.execute(
+            select(WorldVisit).where(
+                WorldVisit.world_id == world_id,
+                WorldVisit.user_id == current_user.id,
+                WorldVisit.visited_at >= cutoff,
+            ).limit(1)
+        )
+        if dedup_res.scalar_one_or_none():
+            is_duplicate = True
+    elif dedup_key:
+        dedup_res = await db.execute(
+            select(WorldVisit).where(
+                WorldVisit.world_id == world_id,
+                WorldVisit.anonymous_token == dedup_key,
+                WorldVisit.visited_at >= cutoff,
+            ).limit(1)
+        )
+        if dedup_res.scalar_one_or_none():
+            is_duplicate = True
+
+    if is_duplicate:
+        return VisitResponse(
+            play_count=world.play_count,
+            last_played_at=world.last_played_at,
+        )
+
+    # 4. Atomic increment and visit log in single transaction
+    await db.execute(
+        update(World)
+        .where(World.id == world_id)
+        .values(
+            play_count=World.play_count + 1,
+            last_played_at=func.now(),
+        )
+    )
+
+    visit = WorldVisit(
+        world_id=world_id,
+        user_id=current_user.id if current_user else None,
+        anonymous_token=dedup_key if not current_user else None,
+    )
+    db.add(visit)
+    await db.commit()
+
+    # Re-fetch or refresh to return updated fields
+    await db.refresh(world)
+
+    return VisitResponse(
+        play_count=world.play_count,
+        last_played_at=world.last_played_at,
+    )
+
+
+@router.get("/categories", response_model=list[str])
+async def list_categories(
+    db: DbDep,
+):
+    """List distinct categories of public worlds."""
+    res = await db.execute(
+        select(World.category)
+        .where(World.category.is_not(None), World.visibility == WorldVisibility.PUBLIC)
+        .distinct()
+        .order_by(World.category)
+    )
+    categories = [c for c in res.scalars().all() if c]
+    return categories
+
+
+@router.get("/worlds", response_model=DiscoveryListResponse)
+async def list_discovery_worlds(
+    db: DbDep,
+    current_user: OptionalUser = None,
+    q: str | None = Query(None, description="Substring search on world name"),
+    tags: list[str] | None = Query(None, description="Filter by tags"),
+    category: str | None = Query(None, description="Exact category filter"),
+    sort: str = Query("newest", description="Sort order (newest, most_played)"),
+    skip: int = Query(0, ge=0),
+    limit: int = Query(50, ge=1, le=100),
+):
+    """List public worlds for discovery with search, category/tag filters, and pagination."""
+    base_query = select(World).where(World.visibility == WorldVisibility.PUBLIC)
+
+    if q:
+        base_query = base_query.where(World.name.ilike(f"%{q}%"))
+
+    if category:
+        base_query = base_query.where(func.lower(World.category) == category.lower())
+
+    if tags:
+        parsed_tags = [t.strip() for item in tags for t in item.split(",") if t.strip()]
+        if parsed_tags:
+            base_query = base_query.where(World.tags.overlap(parsed_tags))
+
+    # Count total matching worlds
+    count_query = select(func.count()).select_from(base_query.subquery())
+    total = (await db.execute(count_query)).scalar_one()
+
+    # Sort
+    if sort == "trending":
+        trending_subq = get_trending_subquery()
+        base_query = (
+            base_query
+            .outerjoin(trending_subq, World.id == trending_subq.c.trending_world_id)
+            .order_by(
+                func.coalesce(trending_subq.c.trending_score, 0.0).desc(),
+                World.play_count.desc(),
+                World.created_at.desc(),
+            )
+        )
+    elif sort == "most_played":
+        base_query = base_query.order_by(World.play_count.desc(), World.created_at.desc())
+    else:  # default: newest
+        base_query = base_query.order_by(World.created_at.desc())
+
+
+    # Pagination & load owner
+    query = (
+        base_query
+        .offset(skip)
+        .limit(limit)
+        .options(selectinload(World.owner))
+    )
+    result = await db.execute(query)
+    worlds = result.scalars().all()
+
+    items = [
+        DiscoveredWorld(
+            id=w.id,
+            name=w.name,
+            description=w.description,
+            category=w.category,
+            tags=w.tags or [],
+            play_count=w.play_count,
+            created_at=w.created_at,
+            owner=WorldOwnerSummary(id=w.owner.id, username=w.owner.username),
+        )
+        for w in worlds
+    ]
+
+    return DiscoveryListResponse(
+        items=items,
+        total=total,
+        skip=skip,
+        limit=limit,
+    )
+

backend/app/routers/groups.py

@@ -0,0 +1,465 @@
+"""Groups API router.
+
+Endpoints:
+- POST   /api/groups                              -- create (creator becomes owner)
+- GET    /api/groups                               -- list groups (paginated), optional mine=true
+- GET    /api/groups/{id}                          -- group page (name/description/members)
+- PATCH  /api/groups/{id}                          -- update name/description (owner/admin)
+- DELETE /api/groups/{id}                          -- delete (owner only)
+- POST   /api/groups/{id}/join                     -- join (idempotent)
+- POST   /api/groups/{id}/leave                    -- leave (owner must transfer first)
+- POST   /api/groups/{id}/members/{user_id}/role   -- set role admin/member (owner only)
+- POST   /api/groups/{id}/transfer                 -- transfer ownership (owner only)
+
+See app/models/groups.py for the schema and delete-behavior rationale
+(docs/planning/social.md US-5). This module owns create/join/leave, role
+authorization, and the group page aggregate.
+"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.groups import Group, GroupMember, GroupRole
+from app.models.user import User
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_NAME_MAX_LEN = 100
+_DESCRIPTION_MAX_LEN = 2000
+
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+
+class GroupCreate(BaseModel):
+    name: str = Field(..., min_length=1, max_length=_NAME_MAX_LEN)
+    description: str | None = Field(default=None, max_length=_DESCRIPTION_MAX_LEN)
+
+    @field_validator("name")
+    @classmethod
+    def strip_name(cls, v: str) -> str:
+        v = v.strip()
+        if not v:
+            raise ValueError("name must not be blank")
+        return v
+
+    @field_validator("description")
+    @classmethod
+    def strip_description(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip() or None
+        return v
+
+
+class GroupUpdate(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=_NAME_MAX_LEN)
+    description: str | None = Field(default=None, max_length=_DESCRIPTION_MAX_LEN)
+
+    @field_validator("name")
+    @classmethod
+    def strip_name(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+            if not v:
+                raise ValueError("name must not be blank")
+        return v
+
+    @field_validator("description")
+    @classmethod
+    def strip_description(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip() or None
+        return v
+
+
+class GroupSummary(BaseModel):
+    id: int
+    name: str
+    description: str | None
+    owner_id: int | None
+    member_count: int
+    created_at: datetime
+
+
+class GroupListResponse(BaseModel):
+    groups: list[GroupSummary]
+    total: int
+
+
+class GroupMemberOut(BaseModel):
+    """Public-safe member entry -- no email or other private User fields."""
+
+    user_id: int
+    username: str
+    role: GroupRole
+    joined_at: datetime
+
+
+class GroupDetail(BaseModel):
+    id: int
+    name: str
+    description: str | None
+    owner_id: int | None
+    member_count: int
+    members: list[GroupMemberOut]
+    created_at: datetime
+
+
+class RoleUpdateRequest(BaseModel):
+    role: GroupRole
+
+    @field_validator("role")
+    @classmethod
+    def only_admin_or_member(cls, v: GroupRole) -> GroupRole:
+        if v == GroupRole.OWNER:
+            raise ValueError(
+                "cannot set role to owner directly -- use POST /transfer"
+            )
+        return v
+
+
+class TransferRequest(BaseModel):
+    new_owner_id: int
+
+
+class MembershipOut(BaseModel):
+    group_id: int
+    user_id: int
+    role: GroupRole
+    joined_at: datetime
+
+
+# ──────────────────────────────── Helpers ─────────────────────────────────────
+
+
+async def _get_group_or_404(db: AsyncSession, group_id: int) -> Group:
+    group = await db.get(Group, group_id)
+    if group is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Group not found")
+    return group
+
+
+async def _get_membership(db: AsyncSession, group_id: int, user_id: int) -> GroupMember | None:
+    result = await db.execute(
+        select(GroupMember).where(
+            GroupMember.group_id == group_id, GroupMember.user_id == user_id
+        )
+    )
+    return result.scalar_one_or_none()
+
+
+async def _member_count(db: AsyncSession, group_id: int) -> int:
+    result = await db.execute(
+        select(func.count()).select_from(GroupMember).where(GroupMember.group_id == group_id)
+    )
+    return int(result.scalar_one())
+
+
+def _require_role(membership: GroupMember | None, *allowed: GroupRole) -> None:
+    if membership is None or membership.role not in allowed:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You do not have permission to perform this action",
+        )
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.post("", response_model=GroupDetail, status_code=status.HTTP_201_CREATED)
+@router.post("/", response_model=GroupDetail, status_code=status.HTTP_201_CREATED, include_in_schema=False)
+async def create_group(
+    body: GroupCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Create a group. The creator becomes its owner."""
+    group = Group(name=body.name, description=body.description, owner_id=current_user.id)
+    db.add(group)
+    await db.flush()
+
+    db.add(GroupMember(group_id=group.id, user_id=current_user.id, role=GroupRole.OWNER))
+    await db.commit()
+    await db.refresh(group)
+
+    return GroupDetail(
+        id=group.id,
+        name=group.name,
+        description=group.description,
+        owner_id=group.owner_id,
+        member_count=1,
+        members=[
+            GroupMemberOut(
+                user_id=current_user.id,
+                username=current_user.username,
+                role=GroupRole.OWNER,
+                joined_at=group.created_at,
+            )
+        ],
+        created_at=group.created_at,
+    )
+
+
+@router.get("", response_model=GroupListResponse)
+@router.get("/", response_model=GroupListResponse, include_in_schema=False)
+async def list_groups(
+    current_user: CurrentUser,
+    db: DbDep,
+    skip: int = Query(0, ge=0),
+    limit: int = Query(50, ge=1, le=100),
+    mine: bool = Query(False, description="If true, only groups the caller is a member of"),
+):
+    """List groups, paginated. With ``mine=true``, restrict to the caller's own groups."""
+    base_query = select(Group)
+    count_query = select(func.count()).select_from(Group)
+
+    if mine:
+        base_query = base_query.join(
+            GroupMember, GroupMember.group_id == Group.id
+        ).where(GroupMember.user_id == current_user.id)
+        count_query = count_query.join(
+            GroupMember, GroupMember.group_id == Group.id
+        ).where(GroupMember.user_id == current_user.id)
+
+    total = (await db.execute(count_query)).scalar_one()
+
+    result = await db.execute(
+        base_query.order_by(Group.created_at.desc()).offset(skip).limit(limit)
+    )
+    groups = result.scalars().all()
+
+    summaries = []
+    for group in groups:
+        summaries.append(
+            GroupSummary(
+                id=group.id,
+                name=group.name,
+                description=group.description,
+                owner_id=group.owner_id,
+                member_count=await _member_count(db, group.id),
+                created_at=group.created_at,
+            )
+        )
+
+    return GroupListResponse(groups=summaries, total=total)
+
+
+@router.get("/{group_id}", response_model=GroupDetail)
+async def get_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Group page: name, description, member count, and member list with roles."""
+    group = await _get_group_or_404(db, group_id)
+
+    result = await db.execute(
+        select(GroupMember, User.username)
+        .join(User, User.id == GroupMember.user_id)
+        .where(GroupMember.group_id == group_id)
+        .order_by(GroupMember.joined_at.asc())
+    )
+    rows = result.all()
+
+    members = [
+        GroupMemberOut(
+            user_id=gm.user_id,
+            username=username,
+            role=gm.role,
+            joined_at=gm.joined_at,
+        )
+        for gm, username in rows
+    ]
+
+    return GroupDetail(
+        id=group.id,
+        name=group.name,
+        description=group.description,
+        owner_id=group.owner_id,
+        member_count=len(members),
+        members=members,
+        created_at=group.created_at,
+    )
+
+
+@router.patch("/{group_id}", response_model=GroupDetail)
+async def update_group(
+    group_id: int,
+    body: GroupUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update name/description. Owner/admin only."""
+    group = await _get_group_or_404(db, group_id)
+    membership = await _get_membership(db, group_id, current_user.id)
+    _require_role(membership, GroupRole.OWNER, GroupRole.ADMIN)
+
+    if body.name is not None:
+        group.name = body.name
+    if body.description is not None:
+        group.description = body.description if body.description else None
+
+    await db.commit()
+    await db.refresh(group)
+
+    return await get_group(group_id, current_user, db)
+
+
+@router.delete("/{group_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Delete a group. Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can delete this group",
+        )
+
+    await db.delete(group)
+    await db.commit()
+    return None
+
+
+@router.post("/{group_id}/join", response_model=MembershipOut)
+async def join_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Join a group. Idempotent -- joining an already-joined group is a no-op."""
+    await _get_group_or_404(db, group_id)
+
+    existing = await _get_membership(db, group_id, current_user.id)
+    if existing is not None:
+        return MembershipOut(
+            group_id=group_id,
+            user_id=current_user.id,
+            role=existing.role,
+            joined_at=existing.joined_at,
+        )
+
+    membership = GroupMember(group_id=group_id, user_id=current_user.id, role=GroupRole.MEMBER)
+    db.add(membership)
+    await db.commit()
+    await db.refresh(membership)
+
+    return MembershipOut(
+        group_id=group_id,
+        user_id=current_user.id,
+        role=membership.role,
+        joined_at=membership.joined_at,
+    )
+
+
+@router.post("/{group_id}/leave", response_model=dict)
+async def leave_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Leave a group. The owner cannot leave without transferring ownership first."""
+    await _get_group_or_404(db, group_id)
+    membership = await _get_membership(db, group_id, current_user.id)
+    if membership is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="You are not a member of this group",
+        )
+
+    if membership.role == GroupRole.OWNER:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Transfer ownership before leaving this group",
+        )
+
+    await db.delete(membership)
+    await db.commit()
+    return {"status": "ok"}
+
+
+@router.post("/{group_id}/members/{user_id}/role", response_model=MembershipOut)
+async def set_member_role(
+    group_id: int,
+    user_id: int,
+    body: RoleUpdateRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Set a member's role (admin/member). Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can change member roles",
+        )
+
+    target = await _get_membership(db, group_id, user_id)
+    if target is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Member not found")
+
+    if target.role == GroupRole.OWNER:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Use POST /transfer to change ownership",
+        )
+
+    target.role = body.role
+    await db.commit()
+    await db.refresh(target)
+
+    return MembershipOut(
+        group_id=group_id, user_id=user_id, role=target.role, joined_at=target.joined_at
+    )
+
+
+@router.post("/{group_id}/transfer", response_model=GroupDetail)
+async def transfer_ownership(
+    group_id: int,
+    body: TransferRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Transfer group ownership to another existing member. Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can transfer ownership",
+        )
+
+    if body.new_owner_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You already own this group",
+        )
+
+    new_owner_membership = await _get_membership(db, group_id, body.new_owner_id)
+    if new_owner_membership is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="New owner must already be a member of this group",
+        )
+
+    current_owner_membership = await _get_membership(db, group_id, current_user.id)
+
+    new_owner_membership.role = GroupRole.OWNER
+    if current_owner_membership is not None:
+        current_owner_membership.role = GroupRole.ADMIN
+    group.owner_id = body.new_owner_id
+
+    await db.commit()
+
+    return await get_group(group_id, current_user, db)

backend/app/routers/internal.py

@@ -0,0 +1,146 @@
+"""Internal, dedicated-server-only content API.
+
+Implements `docs/architecture/world_persistence_impl.md` §7 + §8.3. This is
+how a spawned Godot dedicated server (`scripts/server.gd`, spawned by
+`app.services.game_servers`) pulls its world's content read-only over HTTP
+before binding its ENet port. Mounted at ``/api/internal`` -- a prefix that
+can also be blocked at the reverse proxy, per the doc's rejected-alternative
+note in §7.3.
+
+Gated by ``require_game_server`` (§7.3): a bearer token minted per spawn by
+``GameServerSupervisor._spawn`` and checked against
+``supervisor.validate_token(world_id, token)``. There is no user identity
+here at all -- these routes skip the per-user visibility check public
+routes apply, and apply no mature-content gating (gating is a client/user
+concern; the dedicated server still needs the geometry for collision).
+
+Read-only by construction: there is no write route here, and adding one
+would violate world_persistence_impl.md D2 (the FastAPI backend is the
+only writer).
+"""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Response
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.models.world import World
+from app.models.world_content import MAIN_ROOM_SLUG
+from app.services import chunk_codec
+from app.services.game_servers import supervisor
+from app.services.world_store import Bounds, WorldStore
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+async def require_game_server(
+    world_id: int,
+    authorization: Annotated[str | None, Header()] = None,
+) -> None:
+    """world_persistence_impl.md §7.3. A path whose ``world_id`` differs
+    from the token's world is 403 -- ``validate_token`` enforces that by
+    construction (it looks the token up *by* ``world_id``)."""
+    if not authorization or not authorization.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="missing bearer token")
+    token = authorization.split(" ", 1)[1].strip()
+    if not token or not supervisor.validate_token(world_id, token):
+        raise HTTPException(status_code=403, detail="invalid or expired server token")
+
+
+async def _get_world_or_404(world_id: int, db: AsyncSession) -> World:
+    result = await db.execute(select(World).where(World.id == world_id))
+    world = result.scalar_one_or_none()
+    if world is None:
+        raise HTTPException(status_code=404, detail="World not found")
+    return world
+
+
+async def _resolve_room(store: WorldStore, db: AsyncSession, world_id: int, slug: str):
+    room = await store.get_room(world_id, slug)
+    if room is None and slug == MAIN_ROOM_SLUG:
+        room = await store.get_or_create_main_room(world_id)
+        await db.commit()
+    return room
+
+
+@router.get("/worlds/{world_id}/manifest", dependencies=[Depends(require_game_server)])
+async def manifest(world_id: int, db: DbDep):
+    await _get_world_or_404(world_id, db)
+    store = WorldStore(db)
+    rooms = await store.list_rooms(world_id)
+    if not rooms:
+        rooms = [await store.get_or_create_main_room(world_id)]
+        await db.commit()
+
+    room_payloads = []
+    for r in rooms:
+        room_payloads.append({
+            "slug": r.slug, "name": r.name, "grid": r.grid, "bounds": r.bounds,
+            "spawn": r.spawn, "chunk_count": await store.count_chunks(r.id),
+        })
+
+    return {
+        "world_id": world_id,
+        "content_revision": await store.content_revision(world_id),
+        "rooms": room_payloads,
+    }
+
+
+@router.get("/worlds/{world_id}/rooms/{slug}/chunks", dependencies=[Depends(require_game_server)])
+async def internal_list_chunks(
+    world_id: int, slug: str, db: DbDep,
+    cx_min: int | None = None, cx_max: int | None = None,
+    cy_min: int | None = None, cy_max: int | None = None,
+    cz: int | None = None,
+):
+    await _get_world_or_404(world_id, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    bounds = Bounds(cx_min=cx_min, cx_max=cx_max, cy_min=cy_min, cy_max=cy_max, cz=cz)
+    chunks = await store.list_chunks(world_id, room.id, bounds)
+    return {
+        "room": room.slug,
+        "content_revision": await store.content_revision(world_id),
+        "chunks": [
+            {
+                "key": c.chunk_key, "cx": c.cx, "cy": c.cy, "cz": c.cz,
+                "revision": c.revision, "checksum": c.checksum, "payload_len": c.payload_len,
+                "is_mature": c.is_mature,
+                "updated_at": c.updated_at.isoformat() if c.updated_at else None,
+            }
+            for c in chunks
+        ],
+    }
+
+
+@router.get(
+    "/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}",
+    dependencies=[Depends(require_game_server)],
+)
+async def internal_get_chunk(world_id: int, slug: str, cx: int, cy: int, cz: int, db: DbDep):
+    await _get_world_or_404(world_id, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    key = chunk_codec.build_key(world_id, slug, cx, cy, cz)
+    chunk = await store.get_chunk(key)
+    if chunk is None:
+        raise HTTPException(status_code=404, detail="chunk not found")
+
+    return Response(
+        content=chunk.payload, media_type="application/octet-stream",
+        headers={
+            "ETag": f'"{chunk.checksum}"', "X-Chunk-Revision": str(chunk.revision), "X-Chunk-Key": key,
+        },
+    )

backend/app/routers/marketplace.py

@@ -0,0 +1,607 @@
+"""Marketplace listings API router.
+
+docs/planning/economy.md US-3 (task f51c7d95e237).
+"""
+
+from datetime import datetime
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy import func, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser, OptionalUser
+from app.models.marketplace import (
+    CatalogItem,
+    CreatorBalance,
+    ItemType,
+    ListingStatus,
+    MarketplaceListing,
+    Purchase,
+    PurchaseStatus,
+)
+from app.models.user import User
+from app.services.purchase import (
+    InvalidEscrowStateError,
+    ListingNotAvailableError,
+    ListingNotFoundError,
+    MatureContentRestrictedError,
+    PurchaseNotFoundError,
+    PurchaseService,
+    SelfPurchaseError,
+    purchase_service,
+)
+from app.services.wallet import InsufficientFundsError
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+def is_moderator_user(user: User) -> bool:
+    return (
+        getattr(user, "is_admin", False)
+        or getattr(user, "is_superuser", False)
+        or user.username in ("admin", "moderator", "mod")
+        or user.username.startswith("admin_")
+        or user.username.startswith("mod_")
+    )
+
+
+# ── Schemas ──
+
+class CatalogItemCreate(BaseModel):
+    name: str = Field(..., min_length=1, max_length=100)
+    description: str | None = Field(default=None, max_length=2000)
+    item_type: ItemType
+    asset_id: int | None = None
+    metadata_json: dict[str, Any] | None = None
+
+
+class CatalogItemResponse(BaseModel):
+    id: int
+    owner_id: int
+    asset_id: int | None
+    item_type: ItemType
+    name: str
+    description: str | None
+    metadata_json: dict[str, Any] | None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class ListingCreate(BaseModel):
+    catalog_item_id: int
+    price: int = Field(..., gt=0, description="Price in whole Credits (must be positive)")
+
+
+class ListingUpdate(BaseModel):
+    price: int | None = Field(default=None, gt=0)
+    status: ListingStatus | None = None
+
+
+class ListingResponse(BaseModel):
+    id: int
+    catalog_item_id: int
+    seller_id: int
+    price: int
+    status: ListingStatus
+    created_at: datetime
+    updated_at: datetime
+    catalog_item: CatalogItemResponse | None = None
+    seller_username: str | None = None
+
+    model_config = {"from_attributes": True}
+
+
+class ListingListResponse(BaseModel):
+    listings: list[ListingResponse]
+    total: int
+    limit: int
+    offset: int
+
+
+class PurchaseResponse(BaseModel):
+    id: int
+    listing_id: int | None
+    buyer_id: int
+    seller_id: int
+    price: int
+    platform_fee: int
+    seller_net: int
+    status: PurchaseStatus
+    escrow_hold_until: datetime | None
+    created_at: datetime
+    granted_item_id: int | None = None
+
+    model_config = {"from_attributes": True}
+
+
+class CreatorBalanceResponse(BaseModel):
+    user_id: int
+    available: int
+    pending: int
+    lifetime_earned: int
+    updated_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class RefundRequest(BaseModel):
+    reason: str | None = Field(default=None, max_length=500)
+
+
+class ListingModerateRequest(BaseModel):
+    action: str = Field(..., pattern="^(delist|remove)$")
+    reason: str = Field(..., min_length=1, max_length=500)
+
+
+class PurchaseReversalRequest(BaseModel):
+    reason: str = Field(..., min_length=1, max_length=500)
+
+
+# ── Catalog Items ──
+
+@router.post("/items", response_model=CatalogItemResponse, status_code=status.HTTP_201_CREATED)
+async def create_catalog_item(
+    payload: CatalogItemCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Create a new catalog item owned by the authenticated user."""
+    item = CatalogItem(
+        owner_id=current_user.id,
+        asset_id=payload.asset_id,
+        item_type=payload.item_type,
+        name=payload.name.strip(),
+        description=payload.description.strip() if payload.description else None,
+        metadata_json=payload.metadata_json,
+    )
+    db.add(item)
+    await db.commit()
+    await db.refresh(item)
+    return item
+
+
+@router.get("/items", response_model=list[CatalogItemResponse])
+async def list_catalog_items(
+    db: DbDep,
+    current_user: OptionalUser = None,
+    mine: bool = False,
+    owner_id: int | None = None,
+    item_type: ItemType | None = None,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List catalog items with optional filtering by owner and item type."""
+    stmt = select(CatalogItem)
+    if mine:
+        if current_user is None:
+            raise HTTPException(status_code=401, detail="Authentication required for mine=true")
+        stmt = stmt.where(CatalogItem.owner_id == current_user.id)
+    elif owner_id is not None:
+        stmt = stmt.where(CatalogItem.owner_id == owner_id)
+
+    if item_type is not None:
+        stmt = stmt.where(CatalogItem.item_type == item_type)
+
+    stmt = stmt.order_by(CatalogItem.created_at.desc(), CatalogItem.id.desc()).offset(offset).limit(limit)
+    res = await db.execute(stmt)
+    return list(res.scalars().all())
+
+
+# ── Listings ──
+
+@router.post("/listings", response_model=ListingResponse, status_code=status.HTTP_201_CREATED)
+async def create_listing(
+    payload: ListingCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Create a new marketplace listing for an owned catalog item."""
+    item = await db.get(CatalogItem, payload.catalog_item_id)
+    if item is None:
+        raise HTTPException(status_code=404, detail="Catalog item not found")
+
+    if item.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="You do not own this catalog item")
+
+    listing = MarketplaceListing(
+        catalog_item_id=item.id,
+        seller_id=current_user.id,
+        price=payload.price,
+        status=ListingStatus.active,
+    )
+    db.add(listing)
+    await db.commit()
+    await db.refresh(listing)
+
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=current_user.username,
+    )
+
+
+@router.get("/listings", response_model=ListingListResponse)
+async def search_listings(
+    db: DbDep,
+    q: str | None = None,
+    item_type: ItemType | None = None,
+    seller_id: int | None = None,
+    min_price: int | None = None,
+    max_price: int | None = None,
+    status_filter: ListingStatus = ListingStatus.active,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """Search and browse marketplace listings."""
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+    )
+
+    if status_filter:
+        stmt = stmt.where(MarketplaceListing.status == status_filter)
+    if seller_id is not None:
+        stmt = stmt.where(MarketplaceListing.seller_id == seller_id)
+    if item_type is not None:
+        stmt = stmt.where(CatalogItem.item_type == item_type)
+    if min_price is not None:
+        stmt = stmt.where(MarketplaceListing.price >= min_price)
+    if max_price is not None:
+        stmt = stmt.where(MarketplaceListing.price <= max_price)
+    if q:
+        search_pattern = f"%{q.strip()}%"
+        stmt = stmt.where(
+            or_(
+                CatalogItem.name.ilike(search_pattern),
+                CatalogItem.description.ilike(search_pattern),
+            )
+        )
+
+    # Count
+    count_stmt = select(func.count()).select_from(stmt.subquery())
+    total = (await db.execute(count_stmt)).scalar() or 0
+
+    stmt = stmt.order_by(MarketplaceListing.created_at.desc(), MarketplaceListing.id.desc()).offset(offset).limit(limit)
+    rows = (await db.execute(stmt)).all()
+
+    listings = [
+        ListingResponse(
+            id=listing.id,
+            catalog_item_id=listing.catalog_item_id,
+            seller_id=listing.seller_id,
+            price=listing.price,
+            status=listing.status,
+            created_at=listing.created_at,
+            updated_at=listing.updated_at,
+            catalog_item=CatalogItemResponse.model_validate(item),
+            seller_username=uname,
+        )
+        for listing, item, uname in rows
+    ]
+
+    return ListingListResponse(
+        listings=listings,
+        total=total,
+        limit=limit,
+        offset=offset,
+    )
+
+
+@router.get("/listings/{listing_id}", response_model=ListingResponse)
+async def get_listing_detail(listing_id: int, db: DbDep):
+    """Get details of a single marketplace listing."""
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+        .where(MarketplaceListing.id == listing_id)
+    )
+    res = (await db.execute(stmt)).first()
+    if res is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    listing, item, uname = res
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=uname,
+    )
+
+
+@router.patch("/listings/{listing_id}", response_model=ListingResponse)
+async def update_listing(
+    listing_id: int,
+    payload: ListingUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update a listing's price or status (seller or admin only)."""
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+        .where(MarketplaceListing.id == listing_id)
+    )
+    res = (await db.execute(stmt)).first()
+    if res is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    listing, item, uname = res
+    if listing.seller_id != current_user.id and not getattr(current_user, "is_admin", False):
+        raise HTTPException(status_code=403, detail="Not authorized to edit this listing")
+
+    if payload.price is not None:
+        listing.price = payload.price
+    if payload.status is not None:
+        listing.status = payload.status
+
+    listing.updated_at = datetime.now()
+    await db.commit()
+    await db.refresh(listing)
+
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=uname,
+    )
+
+
+@router.delete("/listings/{listing_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_or_delist_listing(
+    listing_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Delist or delete a listing (seller or admin only)."""
+    listing = await db.get(MarketplaceListing, listing_id)
+    if listing is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    if listing.seller_id != current_user.id and not getattr(current_user, "is_admin", False):
+        raise HTTPException(status_code=403, detail="Not authorized to delete this listing")
+
+    listing.status = ListingStatus.delisted
+    listing.updated_at = datetime.now()
+    await db.commit()
+    return None
+
+
+# ── Purchases & Escrow ──
+
+@router.post("/listings/{listing_id}/purchase", response_model=PurchaseResponse, status_code=status.HTTP_201_CREATED)
+async def purchase_listing(
+    listing_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    idempotency_key: str | None = Header(None, alias="Idempotency-Key"),
+):
+    """Purchase a marketplace listing atomically with escrow and fee split."""
+    try:
+        purchase, granted_item = await purchase_service.purchase_listing(
+            db=db,
+            buyer_id=current_user.id,
+            listing_id=listing_id,
+            buyer_is_adult=current_user.is_adult,
+            idempotency_key=idempotency_key,
+        )
+    except ListingNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except (ListingNotAvailableError, SelfPurchaseError) as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+    except InsufficientFundsError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+    except MatureContentRestrictedError as exc:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=str(exc))
+
+    resp = PurchaseResponse.model_validate(purchase)
+    resp.granted_item_id = granted_item.id
+    return resp
+
+
+@router.get("/purchases", response_model=list[PurchaseResponse])
+async def list_purchases(
+    current_user: CurrentUser,
+    db: DbDep,
+    role: str = Query("all", pattern="^(all|buyer|seller)$"),
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List purchases where the authenticated user is the buyer or seller."""
+    stmt = select(Purchase)
+    if role == "buyer":
+        stmt = stmt.where(Purchase.buyer_id == current_user.id)
+    elif role == "seller":
+        stmt = stmt.where(Purchase.seller_id == current_user.id)
+    else:
+        stmt = stmt.where(
+            or_(Purchase.buyer_id == current_user.id, Purchase.seller_id == current_user.id)
+        )
+
+    stmt = stmt.order_by(Purchase.created_at.desc(), Purchase.id.desc()).offset(offset).limit(limit)
+    res = await db.execute(stmt)
+    return list(res.scalars().all())
+
+
+@router.get("/purchases/{purchase_id}", response_model=PurchaseResponse)
+async def get_purchase(
+    purchase_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Get details of a purchase record."""
+    purchase = await db.get(Purchase, purchase_id)
+    if purchase is None:
+        raise HTTPException(status_code=404, detail="Purchase not found")
+
+    if (
+        purchase.buyer_id != current_user.id
+        and purchase.seller_id != current_user.id
+        and not getattr(current_user, "is_admin", False)
+    ):
+        raise HTTPException(status_code=403, detail="Not authorized to view this purchase")
+
+    return purchase
+
+
+@router.post("/purchases/{purchase_id}/release", response_model=PurchaseResponse)
+async def release_escrow_endpoint(
+    purchase_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Release escrow hold for a purchase to seller's available balance."""
+    purchase = await db.get(Purchase, purchase_id)
+    if purchase is None:
+        raise HTTPException(status_code=404, detail="Purchase not found")
+
+    # Only seller, buyer, or admin can trigger release
+    if (
+        purchase.seller_id != current_user.id
+        and purchase.buyer_id != current_user.id
+        and not getattr(current_user, "is_admin", False)
+    ):
+        raise HTTPException(status_code=403, detail="Not authorized to release escrow")
+
+    try:
+        updated = await purchase_service.release_escrow(db, purchase_id)
+        return updated
+    except InvalidEscrowStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+@router.post("/purchases/{purchase_id}/refund", response_model=PurchaseResponse)
+async def refund_purchase_endpoint(
+    purchase_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    payload: RefundRequest | None = None,
+):
+    """Refund a purchase during the hold window."""
+    purchase = await db.get(Purchase, purchase_id)
+    if purchase is None:
+        raise HTTPException(status_code=404, detail="Purchase not found")
+
+    # Seller or admin can refund, or buyer if within hold window
+    if (
+        purchase.seller_id != current_user.id
+        and purchase.buyer_id != current_user.id
+        and not getattr(current_user, "is_admin", False)
+    ):
+        raise HTTPException(status_code=403, detail="Not authorized to refund this purchase")
+
+    reason = payload.reason if payload else None
+    try:
+        refunded = await purchase_service.refund_purchase(db, purchase_id, reason=reason)
+        return refunded
+    except InvalidEscrowStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+# ── Creator Balance ──
+
+@router.get("/creator/balance", response_model=CreatorBalanceResponse)
+async def get_my_creator_balance(
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Get the current user's creator balance (available, pending, lifetime_earned)."""
+    cb = await purchase_service.get_or_create_creator_balance(db, current_user.id)
+    return cb
+
+
+# ── Moderation ──
+
+@router.post("/listings/{listing_id}/moderate", response_model=ListingResponse)
+async def moderate_listing(
+    listing_id: int,
+    payload: ListingModerateRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Moderator action to delist or remove a listing with reason."""
+    if not is_moderator_user(current_user):
+        raise HTTPException(status_code=403, detail="Moderator or administrator privileges required")
+
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+        .where(MarketplaceListing.id == listing_id)
+    )
+    res = (await db.execute(stmt)).first()
+    if res is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    listing, item, uname = res
+    if payload.action == "remove":
+        listing.status = ListingStatus.removed_by_moderation
+    else:
+        listing.status = ListingStatus.delisted
+
+    listing.updated_at = datetime.now()
+    await db.commit()
+    await db.refresh(listing)
+
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=uname,
+    )
+
+
+@router.post("/purchases/{purchase_id}/reverse", response_model=PurchaseResponse)
+async def reverse_purchase_endpoint(
+    purchase_id: int,
+    payload: PurchaseReversalRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Moderator/admin audited reversal of purchase."""
+    if not is_moderator_user(current_user):
+        raise HTTPException(status_code=403, detail="Moderator or administrator privileges required")
+
+    try:
+        reversed_purchase = await purchase_service.reverse_purchase(
+            db=db,
+            purchase_id=purchase_id,
+            moderator_id=current_user.id,
+            reason=payload.reason,
+        )
+        return reversed_purchase
+    except PurchaseNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except InvalidEscrowStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+

backend/app/routers/payments.py

@@ -0,0 +1,106 @@
+"""Payments API endpoints for purchasing Credits.
+
+docs/planning/economy.md US-2 (task 575fd14b5360).
+"""
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Header, HTTPException, status
+from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.wallet import TransactionType
+from app.services.payment import ALLOWED_CREDIT_PACKS, payment_provider
+from app.services.wallet import wallet_service
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+class PurchaseRequest(BaseModel):
+    credits: int = Field(..., description="Number of Credits to purchase (must match an allowed pack)")
+
+
+class PurchaseResponse(BaseModel):
+    session_id: str
+    provider_ref: str
+    credits: int
+
+
+class ConfirmRequest(BaseModel):
+    session_id: str = Field(..., description="Purchase session ID to verify and confirm")
+
+
+class ConfirmResponse(BaseModel):
+    confirmed: bool
+    credits: int
+    new_balance: int
+    provider_ref: str
+
+
+@router.post("/purchase", response_model=PurchaseResponse, status_code=status.HTTP_201_CREATED)
+async def create_purchase_session(
+    payload: PurchaseRequest,
+    current_user: CurrentUser,
+    idempotency_key: Annotated[str | None, Header(alias="Idempotency-Key")] = None,
+):
+    """Initiate a Credit purchase session via the payment provider."""
+    if payload.credits not in ALLOWED_CREDIT_PACKS:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"Invalid credit pack: {payload.credits}. Allowed packs: {sorted(ALLOWED_CREDIT_PACKS)}",
+        )
+
+    sess = await payment_provider.create_purchase(
+        user_id=current_user.id,
+        credits=payload.credits,
+        idempotency_key=idempotency_key,
+    )
+    return PurchaseResponse(
+        session_id=sess.session_id,
+        provider_ref=sess.provider_ref,
+        credits=sess.credits,
+    )
+
+
+@router.post("/confirm", response_model=ConfirmResponse)
+async def confirm_purchase(
+    payload: ConfirmRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Verify purchase session with provider and credit the user's wallet.
+
+    Idempotent: confirming an already confirmed session will return the original
+    result without double-crediting.
+    """
+    conf = await payment_provider.confirm(payload.session_id)
+    if not conf.confirmed or conf.user_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Payment confirmation failed, invalid session, or unauthorized.",
+        )
+
+    # Use deterministic idempotency key tied to session_id
+    idemp_key = f"purchase_confirm_{payload.session_id}"
+
+    wallet, tx = await wallet_service.credit(
+        db,
+        user_id=current_user.id,
+        amount=conf.credits,
+        tx_type=TransactionType.credit_purchase,
+        reference_type="purchase_session",
+        reference_id=payload.session_id,
+        idempotency_key=idemp_key,
+        metadata={"provider_ref": conf.provider_ref},
+    )
+
+    return ConfirmResponse(
+        confirmed=True,
+        credits=conf.credits,
+        new_balance=wallet.balance,
+        provider_ref=conf.provider_ref,
+    )

backend/app/routers/payouts.py

@@ -0,0 +1,178 @@
+"""Creator payouts router: requests, listings, and admin review.
+
+docs/planning/economy.md US-5 (tasks f5b4684f2e65, b52008923e93).
+"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.marketplace import PayoutRequest, PayoutStatus
+from app.models.user import User
+from app.services.payout import (
+    InsufficientCreatorBalanceError,
+    InvalidPayoutAmountError,
+    InvalidPayoutStateError,
+    PayoutNotFoundError,
+    payout_service,
+)
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+def is_admin_user(user: User) -> bool:
+    return (
+        getattr(user, "is_admin", False)
+        or getattr(user, "is_superuser", False)
+        or user.username in ("admin", "moderator", "mod")
+        or user.username.startswith("admin_")
+        or user.username.startswith("mod_")
+    )
+
+
+class PayoutCreate(BaseModel):
+    amount: int = Field(..., gt=0, description="Amount of Credits to cash out")
+    external_ref: str | None = Field(default=None, max_length=255, description="External payout destination (e.g. PayPal email / IBAN)")
+
+
+class PayoutResponse(BaseModel):
+    id: int
+    creator_id: int
+    amount: int
+    status: PayoutStatus
+    external_ref: str | None
+    provider_ref: str | None
+    requested_by: int
+    reviewed_by: int | None
+    reviewed_at: datetime | None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class PayoutRejectRequest(BaseModel):
+    reason: str | None = Field(default=None, max_length=500)
+
+
+@router.post("", response_model=PayoutResponse, status_code=status.HTTP_201_CREATED)
+async def request_payout(
+    payload: PayoutCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Request a payout of earned creator balance."""
+    try:
+        req = await payout_service.request_payout(
+            db=db,
+            creator_id=current_user.id,
+            amount=payload.amount,
+            external_ref=payload.external_ref,
+            requested_by=current_user.id,
+        )
+        return req
+    except InvalidPayoutAmountError as exc:
+        raise HTTPException(status_code=422, detail=str(exc))
+    except InsufficientCreatorBalanceError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+@router.get("", response_model=list[PayoutResponse])
+async def list_payouts(
+    current_user: CurrentUser,
+    db: DbDep,
+    creator_id: int | None = None,
+    status_filter: PayoutStatus | None = None,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List payout requests. Regular creators can only view their own."""
+    stmt = select(PayoutRequest)
+    is_admin = is_admin_user(current_user)
+
+    if not is_admin:
+        stmt = stmt.where(PayoutRequest.creator_id == current_user.id)
+    else:
+        if creator_id is not None:
+            stmt = stmt.where(PayoutRequest.creator_id == creator_id)
+
+    if status_filter is not None:
+        stmt = stmt.where(PayoutRequest.status == status_filter)
+
+    stmt = stmt.order_by(PayoutRequest.created_at.desc(), PayoutRequest.id.desc()).offset(offset).limit(limit)
+    res = await db.execute(stmt)
+    return list(res.scalars().all())
+
+
+@router.get("/{payout_id}", response_model=PayoutResponse)
+async def get_payout(
+    payout_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Get details of a single payout request."""
+    payout = await db.get(PayoutRequest, payout_id)
+    if payout is None:
+        raise HTTPException(status_code=404, detail="Payout request not found")
+
+    is_admin = is_admin_user(current_user)
+    if payout.creator_id != current_user.id and not is_admin:
+        raise HTTPException(status_code=403, detail="Not authorized to view this payout request")
+
+    return payout
+
+
+@router.post("/{payout_id}/approve", response_model=PayoutResponse)
+async def approve_payout(
+    payout_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Admin review: approve payout and disburse funds via provider."""
+    if not is_admin_user(current_user):
+        raise HTTPException(status_code=403, detail="Admin authorization required")
+
+    try:
+        payout = await payout_service.approve_and_pay(
+            db=db,
+            payout_id=payout_id,
+            reviewer_id=current_user.id,
+        )
+        return payout
+    except PayoutNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except InvalidPayoutStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+@router.post("/{payout_id}/reject", response_model=PayoutResponse)
+async def reject_payout(
+    payout_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    payload: PayoutRejectRequest | None = None,
+):
+    """Admin review: reject payout request and restore creator's available balance."""
+    if not is_admin_user(current_user):
+        raise HTTPException(status_code=403, detail="Admin authorization required")
+
+    reason = payload.reason if payload else None
+    try:
+        payout = await payout_service.reject_payout(
+            db=db,
+            payout_id=payout_id,
+            reviewer_id=current_user.id,
+            reason=reason,
+        )
+        return payout
+    except PayoutNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except InvalidPayoutStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))

backend/app/routers/presence.py

@@ -0,0 +1,146 @@
+"""Presence & status router.
+
+Endpoints:
+- POST  /api/presence/heartbeat  -- record a heartbeat (sets Redis TTL key)
+- GET   /api/presence/presence   -- query presence for a list of user ids
+- PATCH /api/presence/status     -- update the authenticated user's status message
+"""
+
+from datetime import datetime, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, status, Depends
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.user import User
+from app.services.presence import presence_store
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+_STATUS_MAX_LEN = 140
+
+
+class HeartbeatRequest(BaseModel):
+    """Empty body -- the caller's identity comes from the JWT."""
+
+
+class PresenceUser(BaseModel):
+    user_id: int
+    is_online: bool
+    last_seen_at: datetime | None
+    status_message: str | None
+
+
+class PresenceResponse(BaseModel):
+    users: list[PresenceUser]
+
+
+class StatusUpdate(BaseModel):
+    status_message: str | None = Field(default=None, max_length=_STATUS_MAX_LEN)
+
+    @field_validator("status_message")
+    @classmethod
+    def strip_message(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+        return v
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.post("/heartbeat", response_model=dict)
+async def heartbeat(
+    _req: HeartbeatRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Record a heartbeat for the authenticated user.
+
+    Sets a Redis key with a TTL so the server can derive online/offline
+    status without trusting client claims. Also persists last_seen_at to
+    the database.
+    """
+    # Update Redis TTL (presence heartbeat)
+    await presence_store.heartbeat(current_user.id)
+
+    # Persist last_seen_at to the database
+    now = datetime.now(timezone.utc)
+    result = await db.execute(select(User).where(User.id == current_user.id))
+    user = result.scalar_one_or_none()
+    if user:
+        user.last_seen_at = now
+        await db.commit()
+
+    return {"status": "ok", "user_id": current_user.id}
+
+
+@router.get("/presence", response_model=PresenceResponse)
+async def get_presence(
+    user_ids: str,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Return presence info for a comma-separated list of user ids.
+
+    Online/offline is derived from the Redis heartbeat TTL.
+    last_seen_at and status_message come from the database.
+    """
+    ids = [int(uid.strip()) for uid in user_ids.split(",") if uid.strip()]
+    if not ids:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="user_ids must contain at least one integer",
+        )
+
+    # Check Redis for online status (single round trip via MGET).
+    online_ids = await presence_store.is_online_batch(ids)
+
+    # Fetch DB records for last_seen_at and status_message
+    result = await db.execute(select(User).where(User.id.in_(ids)))
+    users = {u.id: u for u in result.scalars().all()}
+
+    presence_users = []
+    for uid in ids:
+        user = users.get(uid)
+        if user is None:
+            continue
+        presence_users.append(
+            PresenceUser(
+                user_id=uid,
+                is_online=uid in online_ids,
+                last_seen_at=user.last_seen_at,
+                status_message=user.status_message,
+            )
+        )
+
+    return PresenceResponse(users=presence_users)
+
+
+@router.patch("/status", response_model=dict)
+async def update_status(
+    body: StatusUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update the authenticated user's status message (length-limited)."""
+    result = await db.execute(select(User).where(User.id == current_user.id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found",
+        )
+
+    user.status_message = body.status_message
+    await db.commit()
+
+    return {"status": "ok", "status_message": body.status_message}